source3/smbd/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Main SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Andrew Bartlett      2001
   6    Copyright (C) Jeremy Allison 1992-2007.
   7    Copyright (C) Volker Lendecke 2007
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles most of the reply_ calls that the server
  24    makes to handle specific protocols
  25 */
  26
  27 #include "includes.h"
  28 #include "system/filesys.h"
  29 #include "printing.h"
  30 #include "smbd/smbd.h"
  31 #include "smbd/globals.h"
  32 #include "fake_file.h"
  33 #include "rpc_client/rpc_client.h"
  34 #include "../librpc/gen_ndr/ndr_spoolss_c.h"
  35 #include "../librpc/gen_ndr/open_files.h"
  36 #include "rpc_client/cli_spoolss.h"
  37 #include "rpc_client/init_spoolss.h"
  38 #include "rpc_server/rpc_ncacn_np.h"
  39 #include "libcli/security/security.h"
  40 #include "libsmb/nmblib.h"
  41 #include "auth.h"
  42 #include "smbprofile.h"
  43 #include "../lib/tsocket/tsocket.h"
  44 #include "lib/tevent_wait.h"
  45 #include "libcli/smb/smb_signing.h"
  46
  47 /****************************************************************************
  48  Ensure we check the path in *exactly* the same way as W2K for a findfirst/findnext
  49  path or anything including wildcards.
  50  We're assuming here that '/' is not the second byte in any multibyte char
  51  set (a safe assumption). '\\' *may* be the second byte in a multibyte char
  52  set.
  53 ****************************************************************************/
  54
  55 /* Custom version for processing POSIX paths. */
  56 #define IS_PATH_SEP(c,posix_only) ((c) == '/' || (!(posix_only) && (c) == '\\'))
  57
  58 static NTSTATUS check_path_syntax_internal(char *path,
  59                                            bool posix_path,
  60                                            bool *p_last_component_contains_wcard)
  61 {
  62         char *d = path;
  63         const char *s = path;
  64         NTSTATUS ret = NT_STATUS_OK;
  65         bool start_of_name_component = True;
  66         bool stream_started = false;
  67
  68         *p_last_component_contains_wcard = False;
  69
  70         while (*s) {
  71                 if (stream_started) {
  72                         switch (*s) {
  73                         case '/':
  74                         case '\\':
  75                                 return NT_STATUS_OBJECT_NAME_INVALID;
  76                         case ':':
  77                                 if (s[1] == '\0') {
  78                                         return NT_STATUS_OBJECT_NAME_INVALID;
  79                                 }
  80                                 if (strchr_m(&s[1], ':')) {
  81                                         return NT_STATUS_OBJECT_NAME_INVALID;
  82                                 }
  83                                 break;
  84                         }
  85                 }
  86
  87                 if ((*s == ':') && !posix_path && !stream_started) {
  88                         if (*p_last_component_contains_wcard) {
  89                                 return NT_STATUS_OBJECT_NAME_INVALID;
  90                         }
  91                         /* Stream names allow more characters than file names.
  92                            We're overloading posix_path here to allow a wider
  93                            range of characters. If stream_started is true this
  94                            is still a Windows path even if posix_path is true.
  95                            JRA.
  96                         */
  97                         stream_started = true;
  98                         start_of_name_component = false;
  99                         posix_path = true;
 100
 101                         if (s[1] == '\0') {
 102                                 return NT_STATUS_OBJECT_NAME_INVALID;
 103                         }
 104                 }
 105
 106                 if (!stream_started && IS_PATH_SEP(*s,posix_path)) {
 107                         /*
 108                          * Safe to assume is not the second part of a mb char
 109                          * as this is handled below.
 110                          */
 111                         /* Eat multiple '/' or '\\' */
 112                         while (IS_PATH_SEP(*s,posix_path)) {
 113                                 s++;
 114                         }
 115                         if ((d != path) && (*s != '\0')) {
 116                                 /* We only care about non-leading or trailing '/' or '\\' */
 117                                 *d++ = '/';
 118                         }
 119
 120                         start_of_name_component = True;
 121                         /* New component. */
 122                         *p_last_component_contains_wcard = False;
 123                         continue;
 124                 }
 125
 126                 if (start_of_name_component) {
 127                         if ((s[0] == '.') && (s[1] == '.') && (IS_PATH_SEP(s[2],posix_path) || s[2] == '\0')) {
 128                                 /* Uh oh - "/../" or "\\..\\"  or "/..\0" or "\\..\0" ! */
 129
 130                                 /*
 131                                  * No mb char starts with '.' so we're safe checking the directory separator here.
 132                                  */
 133
 134                                 /* If  we just added a '/' - delete it */
 135                                 if ((d > path) && (*(d-1) == '/')) {
 136                                         *(d-1) = '\0';
 137                                         d--;
 138                                 }
 139
 140                                 /* Are we at the start ? Can't go back further if so. */
 141                                 if (d <= path) {
 142                                         ret = NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
 143                                         break;
 144                                 }
 145                                 /* Go back one level... */
 146                                 /* We know this is safe as '/' cannot be part of a mb sequence. */
 147                                 /* NOTE - if this assumption is invalid we are not in good shape... */
 148                                 /* Decrement d first as d points to the *next* char to write into. */
 149                                 for (d--; d > path; d--) {
 150                                         if (*d == '/')
 151                                                 break;
 152                                 }
 153                                 s += 2; /* Else go past the .. */
 154                                 /* We're still at the start of a name component, just the previous one. */
 155                                 continue;
 156
 157                         } else if ((s[0] == '.') && ((s[1] == '\0') || IS_PATH_SEP(s[1],posix_path))) {
 158                                 if (posix_path) {
 159                                         /* Eat the '.' */
 160                                         s++;
 161                                         continue;
 162                                 }
 163                         }
 164
 165                 }
 166
 167                 if (!(*s & 0x80)) {
 168                         if (!posix_path) {
 169                                 if (*s <= 0x1f || *s == '|') {
 170                                         return NT_STATUS_OBJECT_NAME_INVALID;
 171                                 }
 172                                 switch (*s) {
 173                                         case '*':
 174                                         case '?':
 175                                         case '<':
 176                                         case '>':
 177                                         case '"':
 178                                                 *p_last_component_contains_wcard = True;
 179                                                 break;
 180                                         default:
 181                                                 break;
 182                                 }
 183                         }
 184                         *d++ = *s++;
 185                 } else {
 186                         size_t siz;
 187                         /* Get the size of the next MB character. */
 188                         next_codepoint(s,&siz);
 189                         switch(siz) {
 190                                 case 5:
 191                                         *d++ = *s++;
 192                                         /*fall through*/
 193                                 case 4:
 194                                         *d++ = *s++;
 195                                         /*fall through*/
 196                                 case 3:
 197                                         *d++ = *s++;
 198                                         /*fall through*/
 199                                 case 2:
 200                                         *d++ = *s++;
 201                                         /*fall through*/
 202                                 case 1:
 203                                         *d++ = *s++;
 204                                         break;
 205                                 default:
 206                                         DEBUG(0,("check_path_syntax_internal: character length assumptions invalid !\n"));
 207                                         *d = '\0';
 208                                         return NT_STATUS_INVALID_PARAMETER;
 209                         }
 210                 }
 211                 start_of_name_component = False;
 212         }
 213
 214         *d = '\0';
 215
 216         return ret;
 217 }
 218
 219 /****************************************************************************
 220  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 221  No wildcards allowed.
 222 ****************************************************************************/
 223
 224 NTSTATUS check_path_syntax(char *path)
 225 {
 226         bool ignore;
 227         return check_path_syntax_internal(path, False, &ignore);
 228 }
 229
 230 /****************************************************************************
 231  Ensure we check the path in *exactly* the same way as W2K for regular pathnames.
 232  Wildcards allowed - p_contains_wcard returns true if the last component contained
 233  a wildcard.
 234 ****************************************************************************/
 235
 236 NTSTATUS check_path_syntax_wcard(char *path, bool *p_contains_wcard)
 237 {
 238         return check_path_syntax_internal(path, False, p_contains_wcard);
 239 }
 240
 241 /****************************************************************************
 242  Check the path for a POSIX client.
 243  We're assuming here that '/' is not the second byte in any multibyte char
 244  set (a safe assumption).
 245 ****************************************************************************/
 246
 247 NTSTATUS check_path_syntax_posix(char *path)
 248 {
 249         bool ignore;
 250         return check_path_syntax_internal(path, True, &ignore);
 251 }
 252
 253 /****************************************************************************
 254  Pull a string and check the path allowing a wilcard - provide for error return.
 255 ****************************************************************************/
 256
 257 size_t srvstr_get_path_wcard(TALLOC_CTX *ctx,
 258                         const char *base_ptr,
 259                         uint16 smb_flags2,
 260                         char **pp_dest,
 261                         const char *src,
 262                         size_t src_len,
 263                         int flags,
 264                         NTSTATUS *err,
 265                         bool *contains_wcard)
 266 {
 267         size_t ret;
 268
 269         *pp_dest = NULL;
 270
 271         ret = srvstr_pull_talloc(ctx, base_ptr, smb_flags2, pp_dest, src,
 272                                  src_len, flags);
 273
 274         if (!*pp_dest) {
 275                 *err = NT_STATUS_INVALID_PARAMETER;
 276                 return ret;
 277         }
 278
 279         *contains_wcard = False;
 280
 281         if (smb_flags2 & FLAGS2_DFS_PATHNAMES) {
 282                 /*
 283                  * For a DFS path the function parse_dfs_path()
 284                  * will do the path processing, just make a copy.
 285                  */
 286                 *err = NT_STATUS_OK;
 287                 return ret;
 288         }
 289
 290         if (lp_posix_pathnames()) {
 291                 *err = check_path_syntax_posix(*pp_dest);
 292         } else {
 293                 *err = check_path_syntax_wcard(*pp_dest, contains_wcard);
 294         }
 295
 296         return ret;
 297 }
 298
 299 /****************************************************************************
 300  Pull a string and check the path - provide for error return.
 301 ****************************************************************************/
 302
 303 size_t srvstr_get_path(TALLOC_CTX *ctx,
 304                         const char *base_ptr,
 305                         uint16 smb_flags2,
 306                         char **pp_dest,
 307                         const char *src,
 308                         size_t src_len,
 309                         int flags,
 310                         NTSTATUS *err)
 311 {
 312         bool ignore;
 313         return srvstr_get_path_wcard(ctx, base_ptr, smb_flags2, pp_dest, src,
 314                                      src_len, flags, err, &ignore);
 315 }
 316
 317 size_t srvstr_get_path_req_wcard(TALLOC_CTX *mem_ctx, struct smb_request *req,
 318                                  char **pp_dest, const char *src, int flags,
 319                                  NTSTATUS *err, bool *contains_wcard)
 320 {
 321         ssize_t bufrem = smbreq_bufrem(req, src);
 322
 323         if (bufrem < 0) {
 324                 *err = NT_STATUS_INVALID_PARAMETER;
 325                 return 0;
 326         }
 327
 328         return srvstr_get_path_wcard(mem_ctx, (const char *)req->inbuf,
 329                                      req->flags2, pp_dest, src, bufrem, flags,
 330                                      err, contains_wcard);
 331 }
 332
 333 size_t srvstr_get_path_req(TALLOC_CTX *mem_ctx, struct smb_request *req,
 334                            char **pp_dest, const char *src, int flags,
 335                            NTSTATUS *err)
 336 {
 337         bool ignore;
 338         return srvstr_get_path_req_wcard(mem_ctx, req, pp_dest, src,
 339                                          flags, err, &ignore);
 340 }
 341
 342 /**
 343  * pull a string from the smb_buf part of a packet. In this case the
 344  * string can either be null terminated or it can be terminated by the
 345  * end of the smbbuf area
 346  */
 347 size_t srvstr_pull_req_talloc(TALLOC_CTX *ctx, struct smb_request *req,
 348                               char **dest, const char *src, int flags)
 349 {
 350         ssize_t bufrem = smbreq_bufrem(req, src);
 351
 352         if (bufrem < 0) {
 353                 return 0;
 354         }
 355
 356         return pull_string_talloc(ctx, req->inbuf, req->flags2, dest, src,
 357                                   bufrem, flags);
 358 }
 359
 360 /****************************************************************************
 361  Check if we have a correct fsp pointing to a file. Basic check for open fsp.
 362 ****************************************************************************/
 363
 364 bool check_fsp_open(connection_struct *conn, struct smb_request *req,
 365                     files_struct *fsp)
 366 {
 367         if ((fsp == NULL) || (conn == NULL)) {
 368                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 369                 return False;
 370         }
 371         if ((conn != fsp->conn) || (req->vuid != fsp->vuid)) {
 372                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 373                 return False;
 374         }
 375         return True;
 376 }
 377
 378 /****************************************************************************
 379  Check if we have a correct fsp pointing to a file.
 380 ****************************************************************************/
 381
 382 bool check_fsp(connection_struct *conn, struct smb_request *req,
 383                files_struct *fsp)
 384 {
 385         if (!check_fsp_open(conn, req, fsp)) {
 386                 return False;
 387         }
 388         if (fsp->is_directory) {
 389                 reply_nterror(req, NT_STATUS_INVALID_DEVICE_REQUEST);
 390                 return False;
 391         }
 392         if (fsp->fh->fd == -1) {
 393                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
 394                 return False;
 395         }
 396         fsp->num_smb_operations++;
 397         return True;
 398 }
 399
 400 /****************************************************************************
 401  Check if we have a correct fsp pointing to a quota fake file. Replacement for
 402  the CHECK_NTQUOTA_HANDLE_OK macro.
 403 ****************************************************************************/
 404
 405 bool check_fsp_ntquota_handle(connection_struct *conn, struct smb_request *req,
 406                               files_struct *fsp)
 407 {
 408         if (!check_fsp_open(conn, req, fsp)) {
 409                 return false;
 410         }
 411
 412         if (fsp->is_directory) {
 413                 return false;
 414         }
 415
 416         if (fsp->fake_file_handle == NULL) {
 417                 return false;
 418         }
 419
 420         if (fsp->fake_file_handle->type != FAKE_FILE_TYPE_QUOTA) {
 421                 return false;
 422         }
 423
 424         if (fsp->fake_file_handle->private_data == NULL) {
 425                 return false;
 426         }
 427
 428         return true;
 429 }
 430
 431 static bool netbios_session_retarget(struct smbd_server_connection *sconn,
 432                                      const char *name, int name_type)
 433 {
 434         char *trim_name;
 435         char *trim_name_type;
 436         const char *retarget_parm;
 437         char *retarget;
 438         char *p;
 439         int retarget_type = 0x20;
 440         int retarget_port = NBT_SMB_PORT;
 441         struct sockaddr_storage retarget_addr;
 442         struct sockaddr_in *in_addr;
 443         bool ret = false;
 444         uint8_t outbuf[10];
 445
 446         if (get_socket_port(sconn->sock) != NBT_SMB_PORT) {
 447                 return false;
 448         }
 449
 450         trim_name = talloc_strdup(talloc_tos(), name);
 451         if (trim_name == NULL) {
 452                 goto fail;
 453         }
 454         trim_char(trim_name, ' ', ' ');
 455
 456         trim_name_type = talloc_asprintf(trim_name, "%s#%2.2x", trim_name,
 457                                          name_type);
 458         if (trim_name_type == NULL) {
 459                 goto fail;
 460         }
 461
 462         retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 463                                              trim_name_type, NULL);
 464         if (retarget_parm == NULL) {
 465                 retarget_parm = lp_parm_const_string(-1, "netbios retarget",
 466                                                      trim_name, NULL);
 467         }
 468         if (retarget_parm == NULL) {
 469                 goto fail;
 470         }
 471
 472         retarget = talloc_strdup(trim_name, retarget_parm);
 473         if (retarget == NULL) {
 474                 goto fail;
 475         }
 476
 477         DEBUG(10, ("retargeting %s to %s\n", trim_name_type, retarget));
 478
 479         p = strchr(retarget, ':');
 480         if (p != NULL) {
 481                 *p++ = '\0';
 482                 retarget_port = atoi(p);
 483         }
 484
 485         p = strchr_m(retarget, '#');
 486         if (p != NULL) {
 487                 *p++ = '\0';
 488                 if (sscanf(p, "%x", &retarget_type) != 1) {
 489                         goto fail;
 490                 }
 491         }
 492
 493         ret = resolve_name(retarget, &retarget_addr, retarget_type, false);
 494         if (!ret) {
 495                 DEBUG(10, ("could not resolve %s\n", retarget));
 496                 goto fail;
 497         }
 498
 499         if (retarget_addr.ss_family != AF_INET) {
 500                 DEBUG(10, ("Retarget target not an IPv4 addr\n"));
 501                 goto fail;
 502         }
 503
 504         in_addr = (struct sockaddr_in *)(void *)&retarget_addr;
 505
 506         _smb_setlen(outbuf, 6);
 507         SCVAL(outbuf, 0, 0x84);
 508         *(uint32_t *)(outbuf+4) = in_addr->sin_addr.s_addr;
 509         *(uint16_t *)(outbuf+8) = htons(retarget_port);
 510
 511         if (!srv_send_smb(sconn, (char *)outbuf, false, 0, false,
 512                           NULL)) {
 513                 exit_server_cleanly("netbios_session_retarget: srv_send_smb "
 514                                     "failed.");
 515         }
 516
 517         ret = true;
 518  fail:
 519         TALLOC_FREE(trim_name);
 520         return ret;
 521 }
 522
 523 static void reply_called_name_not_present(char *outbuf)
 524 {
 525         smb_setlen(outbuf, 1);
 526         SCVAL(outbuf, 0, 0x83);
 527         SCVAL(outbuf, 4, 0x82);
 528 }
 529
 530 /****************************************************************************
 531  Reply to a (netbios-level) special message.
 532 ****************************************************************************/
 533
 534 void reply_special(struct smbd_server_connection *sconn, char *inbuf, size_t inbuf_size)
 535 {
 536         int msg_type = CVAL(inbuf,0);
 537         int msg_flags = CVAL(inbuf,1);
 538         /*
 539          * We only really use 4 bytes of the outbuf, but for the smb_setlen
 540          * calculation & friends (srv_send_smb uses that) we need the full smb
 541          * header.
 542          */
 543         char outbuf[smb_size];
 544
 545         memset(outbuf, '\0', sizeof(outbuf));
 546
 547         smb_setlen(outbuf,0);
 548
 549         switch (msg_type) {
 550         case NBSSrequest: /* session request */
 551         {
 552                 /* inbuf_size is guarenteed to be at least 4. */
 553                 fstring name1,name2;
 554                 int name_type1, name_type2;
 555                 int name_len1, name_len2;
 556
 557                 *name1 = *name2 = 0;
 558
 559                 if (sconn->nbt.got_session) {
 560                         exit_server_cleanly("multiple session request not permitted");
 561                 }
 562
 563                 SCVAL(outbuf,0,NBSSpositive);
 564                 SCVAL(outbuf,3,0);
 565
 566                 /* inbuf_size is guaranteed to be at least 4. */
 567                 name_len1 = name_len((unsigned char *)(inbuf+4),inbuf_size - 4);
 568                 if (name_len1 <= 0 || name_len1 > inbuf_size - 4) {
 569                         DEBUG(0,("Invalid name length in session request\n"));
 570                         reply_called_name_not_present(outbuf);
 571                         break;
 572                 }
 573                 name_len2 = name_len((unsigned char *)(inbuf+4+name_len1),inbuf_size - 4 - name_len1);
 574                 if (name_len2 <= 0 || name_len2 > inbuf_size - 4 - name_len1) {
 575                         DEBUG(0,("Invalid name length in session request\n"));
 576                         reply_called_name_not_present(outbuf);
 577                         break;
 578                 }
 579
 580                 name_type1 = name_extract((unsigned char *)inbuf,
 581                                 inbuf_size,(unsigned int)4,name1);
 582                 name_type2 = name_extract((unsigned char *)inbuf,
 583                                 inbuf_size,(unsigned int)(4 + name_len1),name2);
 584
 585                 if (name_type1 == -1 || name_type2 == -1) {
 586                         DEBUG(0,("Invalid name type in session request\n"));
 587                         reply_called_name_not_present(outbuf);
 588                         break;
 589                 }
 590
 591                 DEBUG(2,("netbios connect: name1=%s0x%x name2=%s0x%x\n",
 592                          name1, name_type1, name2, name_type2));
 593
 594                 if (netbios_session_retarget(sconn, name1, name_type1)) {
 595                         exit_server_cleanly("retargeted client");
 596                 }
 597
 598                 /*
 599                  * Windows NT/2k uses "*SMBSERVER" and XP uses
 600                  * "*SMBSERV" arrggg!!!
 601                  */
 602                 if (strequal(name1, "*SMBSERVER     ")
 603                     || strequal(name1, "*SMBSERV       "))  {
 604                         char *raddr;
 605
 606                         raddr = tsocket_address_inet_addr_string(sconn->remote_address,
 607                                                                  talloc_tos());
 608                         if (raddr == NULL) {
 609                                 exit_server_cleanly("could not allocate raddr");
 610                         }
 611
 612                         fstrcpy(name1, raddr);
 613                 }
 614
 615                 set_local_machine_name(name1, True);
 616                 set_remote_machine_name(name2, True);
 617
 618                 if (is_ipaddress(sconn->remote_hostname)) {
 619                         char *p = discard_const_p(char, sconn->remote_hostname);
 620
 621                         talloc_free(p);
 622
 623                         sconn->remote_hostname = talloc_strdup(sconn,
 624                                                 get_remote_machine_name());
 625                         if (sconn->remote_hostname == NULL) {
 626                                 exit_server_cleanly("could not copy remote name");
 627                         }
 628                         sconn->conn->remote_hostname = sconn->remote_hostname;
 629                 }
 630
 631                 DEBUG(2,("netbios connect: local=%s remote=%s, name type = %x\n",
 632                          get_local_machine_name(), get_remote_machine_name(),
 633                          name_type2));
 634
 635                 if (name_type2 == 'R') {
 636                         /* We are being asked for a pathworks session ---
 637                            no thanks! */
 638                         reply_called_name_not_present(outbuf);
 639                         break;
 640                 }
 641
 642                 reload_services(sconn, conn_snum_used, true);
 643                 reopen_logs();
 644
 645                 sconn->nbt.got_session = true;
 646                 break;
 647         }
 648
 649         case 0x89: /* session keepalive request
 650                       (some old clients produce this?) */
 651                 SCVAL(outbuf,0,NBSSkeepalive);
 652                 SCVAL(outbuf,3,0);
 653                 break;
 654
 655         case NBSSpositive: /* positive session response */
 656         case NBSSnegative: /* negative session response */
 657         case NBSSretarget: /* retarget session response */
 658                 DEBUG(0,("Unexpected session response\n"));
 659                 break;
 660
 661         case NBSSkeepalive: /* session keepalive */
 662         default:
 663                 return;
 664         }
 665
 666         DEBUG(5,("init msg_type=0x%x msg_flags=0x%x\n",
 667                     msg_type, msg_flags));
 668
 669         srv_send_smb(sconn, outbuf, false, 0, false, NULL);
 670
 671         if (CVAL(outbuf, 0) != 0x82) {
 672                 exit_server_cleanly("invalid netbios session");
 673         }
 674         return;
 675 }
 676
 677 /****************************************************************************
 678  Reply to a tcon.
 679  conn POINTER CAN BE NULL HERE !
 680 ****************************************************************************/
 681
 682 void reply_tcon(struct smb_request *req)
 683 {
 684         connection_struct *conn = req->conn;
 685         const char *service;
 686         char *service_buf = NULL;
 687         char *password = NULL;
 688         char *dev = NULL;
 689         int pwlen=0;
 690         NTSTATUS nt_status;
 691         const char *p;
 692         TALLOC_CTX *ctx = talloc_tos();
 693         struct smbd_server_connection *sconn = req->sconn;
 694         NTTIME now = timeval_to_nttime(&req->request_time);
 695
 696         START_PROFILE(SMBtcon);
 697
 698         if (req->buflen < 4) {
 699                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 700                 END_PROFILE(SMBtcon);
 701                 return;
 702         }
 703
 704         p = (const char *)req->buf + 1;
 705         p += srvstr_pull_req_talloc(ctx, req, &service_buf, p, STR_TERMINATE);
 706         p += 1;
 707         pwlen = srvstr_pull_req_talloc(ctx, req, &password, p, STR_TERMINATE);
 708         p += pwlen+1;
 709         p += srvstr_pull_req_talloc(ctx, req, &dev, p, STR_TERMINATE);
 710         p += 1;
 711
 712         if (service_buf == NULL || password == NULL || dev == NULL) {
 713                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 714                 END_PROFILE(SMBtcon);
 715                 return;
 716         }
 717         p = strrchr_m(service_buf,'\\');
 718         if (p) {
 719                 service = p+1;
 720         } else {
 721                 service = service_buf;
 722         }
 723
 724         conn = make_connection(sconn, now, service, dev,
 725                                req->vuid,&nt_status);
 726         req->conn = conn;
 727
 728         if (!conn) {
 729                 reply_nterror(req, nt_status);
 730                 END_PROFILE(SMBtcon);
 731                 return;
 732         }
 733
 734         reply_outbuf(req, 2, 0);
 735         SSVAL(req->outbuf,smb_vwv0,sconn->smb1.negprot.max_recv);
 736         SSVAL(req->outbuf,smb_vwv1,conn->cnum);
 737         SSVAL(req->outbuf,smb_tid,conn->cnum);
 738
 739         DEBUG(3,("tcon service=%s cnum=%d\n",
 740                  service, conn->cnum));
 741
 742         END_PROFILE(SMBtcon);
 743         return;
 744 }
 745
 746 /****************************************************************************
 747  Reply to a tcon and X.
 748  conn POINTER CAN BE NULL HERE !
 749 ****************************************************************************/
 750
 751 void reply_tcon_and_X(struct smb_request *req)
 752 {
 753         connection_struct *conn = req->conn;
 754         const char *service = NULL;
 755         TALLOC_CTX *ctx = talloc_tos();
 756         /* what the cleint thinks the device is */
 757         char *client_devicetype = NULL;
 758         /* what the server tells the client the share represents */
 759         const char *server_devicetype;
 760         NTSTATUS nt_status;
 761         int passlen;
 762         char *path = NULL;
 763         const char *p, *q;
 764         uint16_t tcon_flags;
 765         struct smbXsrv_session *session = NULL;
 766         NTTIME now = timeval_to_nttime(&req->request_time);
 767         bool session_key_updated = false;
 768         uint16_t optional_support = 0;
 769         struct smbd_server_connection *sconn = req->sconn;
 770
 771         START_PROFILE(SMBtconX);
 772
 773         if (req->wct < 4) {
 774                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 775                 END_PROFILE(SMBtconX);
 776                 return;
 777         }
 778
 779         passlen = SVAL(req->vwv+3, 0);
 780         tcon_flags = SVAL(req->vwv+2, 0);
 781
 782         /* we might have to close an old one */
 783         if ((tcon_flags & TCONX_FLAG_DISCONNECT_TID) && conn) {
 784                 struct smbXsrv_tcon *tcon;
 785                 NTSTATUS status;
 786
 787                 tcon = conn->tcon;
 788                 req->conn = NULL;
 789                 conn = NULL;
 790
 791                 /*
 792                  * TODO: cancel all outstanding requests on the tcon
 793                  */
 794                 status = smbXsrv_tcon_disconnect(tcon, req->vuid);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(0, ("reply_tcon_and_X: "
 797                                   "smbXsrv_tcon_disconnect() failed: %s\n",
 798                                   nt_errstr(status)));
 799                         /*
 800                          * If we hit this case, there is something completely
 801                          * wrong, so we better disconnect the transport connection.
 802                          */
 803                         END_PROFILE(SMBtconX);
 804                         exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
 805                         return;
 806                 }
 807
 808                 TALLOC_FREE(tcon);
 809         }
 810
 811         if ((passlen > MAX_PASS_LEN) || (passlen >= req->buflen)) {
 812                 reply_force_doserror(req, ERRDOS, ERRbuftoosmall);
 813                 END_PROFILE(SMBtconX);
 814                 return;
 815         }
 816
 817         if (sconn->smb1.negprot.encrypted_passwords) {
 818                 p = (const char *)req->buf + passlen;
 819         } else {
 820                 p = (const char *)req->buf + passlen + 1;
 821         }
 822
 823         p += srvstr_pull_req_talloc(ctx, req, &path, p, STR_TERMINATE);
 824
 825         if (path == NULL) {
 826                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 827                 END_PROFILE(SMBtconX);
 828                 return;
 829         }
 830
 831         /*
 832          * the service name can be either: \\server\share
 833          * or share directly like on the DELL PowerVault 705
 834          */
 835         if (*path=='\\') {
 836                 q = strchr_m(path+2,'\\');
 837                 if (!q) {
 838                         reply_nterror(req, NT_STATUS_BAD_NETWORK_NAME);
 839                         END_PROFILE(SMBtconX);
 840                         return;
 841                 }
 842                 service = q+1;
 843         } else {
 844                 service = path;
 845         }
 846
 847         p += srvstr_pull_talloc(ctx, req->inbuf, req->flags2,
 848                                 &client_devicetype, p,
 849                                 MIN(6, smbreq_bufrem(req, p)), STR_ASCII);
 850
 851         if (client_devicetype == NULL) {
 852                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
 853                 END_PROFILE(SMBtconX);
 854                 return;
 855         }
 856
 857         DEBUG(4,("Client requested device type [%s] for share [%s]\n", client_devicetype, service));
 858
 859         nt_status = smb1srv_session_lookup(req->sconn->conn,
 860                                            req->vuid, now, &session);
 861         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_USER_SESSION_DELETED)) {
 862                 reply_force_doserror(req, ERRSRV, ERRbaduid);
 863                 END_PROFILE(SMBtconX);
 864                 return;
 865         }
 866         if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
 867                 reply_nterror(req, nt_status);
 868                 END_PROFILE(SMBtconX);
 869                 return;
 870         }
 871         if (!NT_STATUS_IS_OK(nt_status)) {
 872                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 873                 END_PROFILE(SMBtconX);
 874                 return;
 875         }
 876
 877         if (session->global->auth_session_info == NULL) {
 878                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 879                 END_PROFILE(SMBtconX);
 880                 return;
 881         }
 882
 883         /*
 884          * If there is no application key defined yet
 885          * we create one.
 886          *
 887          * This means we setup the application key on the
 888          * first tcon that happens via the given session.
 889          *
 890          * Once the application key is defined, it does not
 891          * change any more.
 892          */
 893         if (session->global->application_key.length == 0 &&
 894             session->global->signing_key.length > 0)
 895         {
 896                 struct smbXsrv_session *x = session;
 897                 struct auth_session_info *session_info =
 898                         session->global->auth_session_info;
 899                 uint8_t session_key[16];
 900
 901                 ZERO_STRUCT(session_key);
 902                 memcpy(session_key, x->global->signing_key.data,
 903                        MIN(x->global->signing_key.length, sizeof(session_key)));
 904
 905                 /*
 906                  * The application key is truncated/padded to 16 bytes
 907                  */
 908                 x->global->application_key = data_blob_talloc(x->global,
 909                                                              session_key,
 910                                                              sizeof(session_key));
 911                 ZERO_STRUCT(session_key);
 912                 if (x->global->application_key.data == NULL) {
 913                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 914                         END_PROFILE(SMBtconX);
 915                         return;
 916                 }
 917
 918                 if (tcon_flags & TCONX_FLAG_EXTENDED_SIGNATURES) {
 919                         smb_key_derivation(x->global->application_key.data,
 920                                            x->global->application_key.length,
 921                                            x->global->application_key.data);
 922                         optional_support |= SMB_EXTENDED_SIGNATURES;
 923                 }
 924
 925                 /*
 926                  * Place the application key into the session_info
 927                  */
 928                 data_blob_clear_free(&session_info->session_key);
 929                 session_info->session_key = data_blob_dup_talloc(session_info,
 930                                                 x->global->application_key);
 931                 if (session_info->session_key.data == NULL) {
 932                         data_blob_clear_free(&x->global->application_key);
 933                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 934                         END_PROFILE(SMBtconX);
 935                         return;
 936                 }
 937                 session_key_updated = true;
 938         }
 939
 940         conn = make_connection(sconn, now, service, client_devicetype,
 941                                req->vuid, &nt_status);
 942         req->conn =conn;
 943
 944         if (!conn) {
 945                 if (session_key_updated) {
 946                         struct smbXsrv_session *x = session;
 947                         struct auth_session_info *session_info =
 948                                 session->global->auth_session_info;
 949                         data_blob_clear_free(&x->global->application_key);
 950                         data_blob_clear_free(&session_info->session_key);
 951                 }
 952                 reply_nterror(req, nt_status);
 953                 END_PROFILE(SMBtconX);
 954                 return;
 955         }
 956
 957         if ( IS_IPC(conn) )
 958                 server_devicetype = "IPC";
 959         else if ( IS_PRINT(conn) )
 960                 server_devicetype = "LPT1:";
 961         else
 962                 server_devicetype = "A:";
 963
 964         if (get_Protocol() < PROTOCOL_NT1) {
 965                 reply_outbuf(req, 2, 0);
 966                 if (message_push_string(&req->outbuf, server_devicetype,
 967                                         STR_TERMINATE|STR_ASCII) == -1) {
 968                         reply_nterror(req, NT_STATUS_NO_MEMORY);
 969                         END_PROFILE(SMBtconX);
 970                         return;
 971                 }
 972         } else {
 973                 /* NT sets the fstype of IPC$ to the null string */
 974                 const char *fstype = IS_IPC(conn) ? "" : lp_fstype(ctx, SNUM(conn));
 975
 976                 if (tcon_flags & TCONX_FLAG_EXTENDED_RESPONSE) {
 977                         /* Return permissions. */
 978                         uint32 perm1 = 0;
 979                         uint32 perm2 = 0;
 980
 981                         reply_outbuf(req, 7, 0);
 982
 983                         if (IS_IPC(conn)) {
 984                                 perm1 = FILE_ALL_ACCESS;
 985                                 perm2 = FILE_ALL_ACCESS;
 986                         } else {
 987                                 perm1 = conn->share_access;
 988                         }
 989
 990                         SIVAL(req->outbuf, smb_vwv3, perm1);
 991                         SIVAL(req->outbuf, smb_vwv5, perm2);
 992                 } else {
 993                         reply_outbuf(req, 3, 0);
 994                 }
 995
 996                 if ((message_push_string(&req->outbuf, server_devicetype,
 997                                          STR_TERMINATE|STR_ASCII) == -1)
 998                     || (message_push_string(&req->outbuf, fstype,
 999                                             STR_TERMINATE) == -1)) {
1000                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1001                         END_PROFILE(SMBtconX);
1002                         return;
1003                 }
1004
1005                 /* what does setting this bit do? It is set by NT4 and
1006                    may affect the ability to autorun mounted cdroms */
1007                 optional_support |= SMB_SUPPORT_SEARCH_BITS;
1008                 optional_support |=
1009                         (lp_csc_policy(SNUM(conn)) << SMB_CSC_POLICY_SHIFT);
1010
1011                 if (lp_msdfs_root(SNUM(conn)) && lp_host_msdfs()) {
1012                         DEBUG(2,("Serving %s as a Dfs root\n",
1013                                  lp_servicename(ctx, SNUM(conn)) ));
1014                         optional_support |= SMB_SHARE_IN_DFS;
1015                 }
1016
1017                 SSVAL(req->outbuf, smb_vwv2, optional_support);
1018         }
1019
1020         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
1021         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
1022
1023         DEBUG(3,("tconX service=%s \n",
1024                  service));
1025
1026         /* set the incoming and outgoing tid to the just created one */
1027         SSVAL(discard_const_p(uint8_t, req->inbuf),smb_tid,conn->cnum);
1028         SSVAL(req->outbuf,smb_tid,conn->cnum);
1029
1030         END_PROFILE(SMBtconX);
1031
1032         req->tid = conn->cnum;
1033 }
1034
1035 /****************************************************************************
1036  Reply to an unknown type.
1037 ****************************************************************************/
1038
1039 void reply_unknown_new(struct smb_request *req, uint8 type)
1040 {
1041         DEBUG(0, ("unknown command type (%s): type=%d (0x%X)\n",
1042                   smb_fn_name(type), type, type));
1043         reply_force_doserror(req, ERRSRV, ERRunknownsmb);
1044         return;
1045 }
1046
1047 /****************************************************************************
1048  Reply to an ioctl.
1049  conn POINTER CAN BE NULL HERE !
1050 ****************************************************************************/
1051
1052 void reply_ioctl(struct smb_request *req)
1053 {
1054         connection_struct *conn = req->conn;
1055         uint16 device;
1056         uint16 function;
1057         uint32 ioctl_code;
1058         int replysize;
1059         char *p;
1060
1061         START_PROFILE(SMBioctl);
1062
1063         if (req->wct < 3) {
1064                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1065                 END_PROFILE(SMBioctl);
1066                 return;
1067         }
1068
1069         device     = SVAL(req->vwv+1, 0);
1070         function   = SVAL(req->vwv+2, 0);
1071         ioctl_code = (device << 16) + function;
1072
1073         DEBUG(4, ("Received IOCTL (code 0x%x)\n", ioctl_code));
1074
1075         switch (ioctl_code) {
1076             case IOCTL_QUERY_JOB_INFO:
1077                     replysize = 32;
1078                     break;
1079             default:
1080                     reply_force_doserror(req, ERRSRV, ERRnosupport);
1081                     END_PROFILE(SMBioctl);
1082                     return;
1083         }
1084
1085         reply_outbuf(req, 8, replysize+1);
1086         SSVAL(req->outbuf,smb_vwv1,replysize); /* Total data bytes returned */
1087         SSVAL(req->outbuf,smb_vwv5,replysize); /* Data bytes this buffer */
1088         SSVAL(req->outbuf,smb_vwv6,52);        /* Offset to data */
1089         p = smb_buf(req->outbuf);
1090         memset(p, '\0', replysize+1); /* valgrind-safe. */
1091         p += 1;          /* Allow for alignment */
1092
1093         switch (ioctl_code) {
1094                 case IOCTL_QUERY_JOB_INFO:
1095                 {
1096                         files_struct *fsp = file_fsp(
1097                                 req, SVAL(req->vwv+0, 0));
1098                         if (!fsp) {
1099                                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
1100                                 END_PROFILE(SMBioctl);
1101                                 return;
1102                         }
1103                         /* Job number */
1104                         SSVAL(p, 0, print_spool_rap_jobid(fsp->print_file));
1105
1106                         srvstr_push((char *)req->outbuf, req->flags2, p+2,
1107                                     lp_netbios_name(), 15,
1108                                     STR_TERMINATE|STR_ASCII);
1109                         if (conn) {
1110                                 srvstr_push((char *)req->outbuf, req->flags2,
1111                                             p+18,
1112                                             lp_servicename(talloc_tos(),
1113                                                            SNUM(conn)),
1114                                             13, STR_TERMINATE|STR_ASCII);
1115                         } else {
1116                                 memset(p+18, 0, 13);
1117                         }
1118                         break;
1119                 }
1120         }
1121
1122         END_PROFILE(SMBioctl);
1123         return;
1124 }
1125
1126 /****************************************************************************
1127  Strange checkpath NTSTATUS mapping.
1128 ****************************************************************************/
1129
1130 static NTSTATUS map_checkpath_error(uint16_t flags2, NTSTATUS status)
1131 {
1132         /* Strange DOS error code semantics only for checkpath... */
1133         if (!(flags2 & FLAGS2_32_BIT_ERROR_CODES)) {
1134                 if (NT_STATUS_EQUAL(NT_STATUS_OBJECT_NAME_INVALID,status)) {
1135                         /* We need to map to ERRbadpath */
1136                         return NT_STATUS_OBJECT_PATH_NOT_FOUND;
1137                 }
1138         }
1139         return status;
1140 }
1141
1142 /****************************************************************************
1143  Reply to a checkpath.
1144 ****************************************************************************/
1145
1146 void reply_checkpath(struct smb_request *req)
1147 {
1148         connection_struct *conn = req->conn;
1149         struct smb_filename *smb_fname = NULL;
1150         char *name = NULL;
1151         NTSTATUS status;
1152         TALLOC_CTX *ctx = talloc_tos();
1153
1154         START_PROFILE(SMBcheckpath);
1155
1156         srvstr_get_path_req(ctx, req, &name, (const char *)req->buf + 1,
1157                             STR_TERMINATE, &status);
1158
1159         if (!NT_STATUS_IS_OK(status)) {
1160                 status = map_checkpath_error(req->flags2, status);
1161                 reply_nterror(req, status);
1162                 END_PROFILE(SMBcheckpath);
1163                 return;
1164         }
1165
1166         DEBUG(3,("reply_checkpath %s mode=%d\n", name, (int)SVAL(req->vwv+0, 0)));
1167
1168         status = filename_convert(ctx,
1169                                 conn,
1170                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1171                                 name,
1172                                 0,
1173                                 NULL,
1174                                 &smb_fname);
1175
1176         if (!NT_STATUS_IS_OK(status)) {
1177                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1178                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1179                                         ERRSRV, ERRbadpath);
1180                         END_PROFILE(SMBcheckpath);
1181                         return;
1182                 }
1183                 goto path_err;
1184         }
1185
1186         if (!VALID_STAT(smb_fname->st) &&
1187             (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1188                 DEBUG(3,("reply_checkpath: stat of %s failed (%s)\n",
1189                         smb_fname_str_dbg(smb_fname), strerror(errno)));
1190                 status = map_nt_error_from_unix(errno);
1191                 goto path_err;
1192         }
1193
1194         if (!S_ISDIR(smb_fname->st.st_ex_mode)) {
1195                 reply_botherror(req, NT_STATUS_NOT_A_DIRECTORY,
1196                                 ERRDOS, ERRbadpath);
1197                 goto out;
1198         }
1199
1200         reply_outbuf(req, 0, 0);
1201
1202  path_err:
1203         /* We special case this - as when a Windows machine
1204                 is parsing a path is steps through the components
1205                 one at a time - if a component fails it expects
1206                 ERRbadpath, not ERRbadfile.
1207         */
1208         status = map_checkpath_error(req->flags2, status);
1209         if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
1210                 /*
1211                  * Windows returns different error codes if
1212                  * the parent directory is valid but not the
1213                  * last component - it returns NT_STATUS_OBJECT_NAME_NOT_FOUND
1214                  * for that case and NT_STATUS_OBJECT_PATH_NOT_FOUND
1215                  * if the path is invalid.
1216                  */
1217                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
1218                                 ERRDOS, ERRbadpath);
1219                 goto out;
1220         }
1221
1222         reply_nterror(req, status);
1223
1224  out:
1225         TALLOC_FREE(smb_fname);
1226         END_PROFILE(SMBcheckpath);
1227         return;
1228 }
1229
1230 /****************************************************************************
1231  Reply to a getatr.
1232 ****************************************************************************/
1233
1234 void reply_getatr(struct smb_request *req)
1235 {
1236         connection_struct *conn = req->conn;
1237         struct smb_filename *smb_fname = NULL;
1238         char *fname = NULL;
1239         int mode=0;
1240         off_t size=0;
1241         time_t mtime=0;
1242         const char *p;
1243         NTSTATUS status;
1244         TALLOC_CTX *ctx = talloc_tos();
1245         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1246
1247         START_PROFILE(SMBgetatr);
1248
1249         p = (const char *)req->buf + 1;
1250         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1251         if (!NT_STATUS_IS_OK(status)) {
1252                 reply_nterror(req, status);
1253                 goto out;
1254         }
1255
1256         /* dos smetimes asks for a stat of "" - it returns a "hidden directory"
1257                 under WfWg - weird! */
1258         if (*fname == '\0') {
1259                 mode = FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_DIRECTORY;
1260                 if (!CAN_WRITE(conn)) {
1261                         mode |= FILE_ATTRIBUTE_READONLY;
1262                 }
1263                 size = 0;
1264                 mtime = 0;
1265         } else {
1266                 status = filename_convert(ctx,
1267                                 conn,
1268                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1269                                 fname,
1270                                 0,
1271                                 NULL,
1272                                 &smb_fname);
1273                 if (!NT_STATUS_IS_OK(status)) {
1274                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1275                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1276                                                 ERRSRV, ERRbadpath);
1277                                 goto out;
1278                         }
1279                         reply_nterror(req, status);
1280                         goto out;
1281                 }
1282                 if (!VALID_STAT(smb_fname->st) &&
1283                     (SMB_VFS_STAT(conn, smb_fname) != 0)) {
1284                         DEBUG(3,("reply_getatr: stat of %s failed (%s)\n",
1285                                  smb_fname_str_dbg(smb_fname),
1286                                  strerror(errno)));
1287                         reply_nterror(req,  map_nt_error_from_unix(errno));
1288                         goto out;
1289                 }
1290
1291                 mode = dos_mode(conn, smb_fname);
1292                 size = smb_fname->st.st_ex_size;
1293
1294                 if (ask_sharemode) {
1295                         struct timespec write_time_ts;
1296                         struct file_id fileid;
1297
1298                         ZERO_STRUCT(write_time_ts);
1299                         fileid = vfs_file_id_from_sbuf(conn, &smb_fname->st);
1300                         get_file_infos(fileid, 0, NULL, &write_time_ts);
1301                         if (!null_timespec(write_time_ts)) {
1302                                 update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1303                         }
1304                 }
1305
1306                 mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1307                 if (mode & FILE_ATTRIBUTE_DIRECTORY) {
1308                         size = 0;
1309                 }
1310         }
1311
1312         reply_outbuf(req, 10, 0);
1313
1314         SSVAL(req->outbuf,smb_vwv0,mode);
1315         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1316                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime & ~1);
1317         } else {
1318                 srv_put_dos_date3((char *)req->outbuf,smb_vwv1,mtime);
1319         }
1320         SIVAL(req->outbuf,smb_vwv3,(uint32)size);
1321
1322         if (get_Protocol() >= PROTOCOL_NT1) {
1323                 SSVAL(req->outbuf, smb_flg2,
1324                       SVAL(req->outbuf, smb_flg2) | FLAGS2_IS_LONG_NAME);
1325         }
1326
1327         DEBUG(3,("reply_getatr: name=%s mode=%d size=%u\n",
1328                  smb_fname_str_dbg(smb_fname), mode, (unsigned int)size));
1329
1330  out:
1331         TALLOC_FREE(smb_fname);
1332         TALLOC_FREE(fname);
1333         END_PROFILE(SMBgetatr);
1334         return;
1335 }
1336
1337 /****************************************************************************
1338  Reply to a setatr.
1339 ****************************************************************************/
1340
1341 void reply_setatr(struct smb_request *req)
1342 {
1343         struct smb_file_time ft;
1344         connection_struct *conn = req->conn;
1345         struct smb_filename *smb_fname = NULL;
1346         char *fname = NULL;
1347         int mode;
1348         time_t mtime;
1349         const char *p;
1350         NTSTATUS status;
1351         TALLOC_CTX *ctx = talloc_tos();
1352
1353         START_PROFILE(SMBsetatr);
1354
1355         ZERO_STRUCT(ft);
1356
1357         if (req->wct < 2) {
1358                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1359                 goto out;
1360         }
1361
1362         p = (const char *)req->buf + 1;
1363         p += srvstr_get_path_req(ctx, req, &fname, p, STR_TERMINATE, &status);
1364         if (!NT_STATUS_IS_OK(status)) {
1365                 reply_nterror(req, status);
1366                 goto out;
1367         }
1368
1369         status = filename_convert(ctx,
1370                                 conn,
1371                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1372                                 fname,
1373                                 0,
1374                                 NULL,
1375                                 &smb_fname);
1376         if (!NT_STATUS_IS_OK(status)) {
1377                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1378                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1379                                         ERRSRV, ERRbadpath);
1380                         goto out;
1381                 }
1382                 reply_nterror(req, status);
1383                 goto out;
1384         }
1385
1386         if (smb_fname->base_name[0] == '.' &&
1387             smb_fname->base_name[1] == '\0') {
1388                 /*
1389                  * Not sure here is the right place to catch this
1390                  * condition. Might be moved to somewhere else later -- vl
1391                  */
1392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
1393                 goto out;
1394         }
1395
1396         mode = SVAL(req->vwv+0, 0);
1397         mtime = srv_make_unix_date3(req->vwv+1);
1398
1399         if (mode != FILE_ATTRIBUTE_NORMAL) {
1400                 if (VALID_STAT_OF_DIR(smb_fname->st))
1401                         mode |= FILE_ATTRIBUTE_DIRECTORY;
1402                 else
1403                         mode &= ~FILE_ATTRIBUTE_DIRECTORY;
1404
1405                 status = check_access(conn, NULL, smb_fname,
1406                                         FILE_WRITE_ATTRIBUTES);
1407                 if (!NT_STATUS_IS_OK(status)) {
1408                         reply_nterror(req, status);
1409                         goto out;
1410                 }
1411
1412                 if (file_set_dosmode(conn, smb_fname, mode, NULL,
1413                                      false) != 0) {
1414                         reply_nterror(req, map_nt_error_from_unix(errno));
1415                         goto out;
1416                 }
1417         }
1418
1419         ft.mtime = convert_time_t_to_timespec(mtime);
1420         status = smb_set_file_time(conn, NULL, smb_fname, &ft, true);
1421         if (!NT_STATUS_IS_OK(status)) {
1422                 reply_nterror(req, status);
1423                 goto out;
1424         }
1425
1426         reply_outbuf(req, 0, 0);
1427
1428         DEBUG(3, ("setatr name=%s mode=%d\n", smb_fname_str_dbg(smb_fname),
1429                  mode));
1430  out:
1431         TALLOC_FREE(smb_fname);
1432         END_PROFILE(SMBsetatr);
1433         return;
1434 }
1435
1436 /****************************************************************************
1437  Reply to a dskattr.
1438 ****************************************************************************/
1439
1440 void reply_dskattr(struct smb_request *req)
1441 {
1442         connection_struct *conn = req->conn;
1443         uint64_t dfree,dsize,bsize;
1444         START_PROFILE(SMBdskattr);
1445
1446         if (get_dfree_info(conn,".",True,&bsize,&dfree,&dsize) == (uint64_t)-1) {
1447                 reply_nterror(req, map_nt_error_from_unix(errno));
1448                 END_PROFILE(SMBdskattr);
1449                 return;
1450         }
1451
1452         reply_outbuf(req, 5, 0);
1453
1454         if (get_Protocol() <= PROTOCOL_LANMAN2) {
1455                 double total_space, free_space;
1456                 /* we need to scale this to a number that DOS6 can handle. We
1457                    use floating point so we can handle large drives on systems
1458                    that don't have 64 bit integers
1459
1460                    we end up displaying a maximum of 2G to DOS systems
1461                 */
1462                 total_space = dsize * (double)bsize;
1463                 free_space = dfree * (double)bsize;
1464
1465                 dsize = (uint64_t)((total_space+63*512) / (64*512));
1466                 dfree = (uint64_t)((free_space+63*512) / (64*512));
1467
1468                 if (dsize > 0xFFFF) dsize = 0xFFFF;
1469                 if (dfree > 0xFFFF) dfree = 0xFFFF;
1470
1471                 SSVAL(req->outbuf,smb_vwv0,dsize);
1472                 SSVAL(req->outbuf,smb_vwv1,64); /* this must be 64 for dos systems */
1473                 SSVAL(req->outbuf,smb_vwv2,512); /* and this must be 512 */
1474                 SSVAL(req->outbuf,smb_vwv3,dfree);
1475         } else {
1476                 SSVAL(req->outbuf,smb_vwv0,dsize);
1477                 SSVAL(req->outbuf,smb_vwv1,bsize/512);
1478                 SSVAL(req->outbuf,smb_vwv2,512);
1479                 SSVAL(req->outbuf,smb_vwv3,dfree);
1480         }
1481
1482         DEBUG(3,("dskattr dfree=%d\n", (unsigned int)dfree));
1483
1484         END_PROFILE(SMBdskattr);
1485         return;
1486 }
1487
1488 /*
1489  * Utility function to split the filename from the directory.
1490  */
1491 static NTSTATUS split_fname_dir_mask(TALLOC_CTX *ctx, const char *fname_in,
1492                                      char **fname_dir_out,
1493                                      char **fname_mask_out)
1494 {
1495         const char *p = NULL;
1496         char *fname_dir = NULL;
1497         char *fname_mask = NULL;
1498
1499         p = strrchr_m(fname_in, '/');
1500         if (!p) {
1501                 fname_dir = talloc_strdup(ctx, ".");
1502                 fname_mask = talloc_strdup(ctx, fname_in);
1503         } else {
1504                 fname_dir = talloc_strndup(ctx, fname_in,
1505                     PTR_DIFF(p, fname_in));
1506                 fname_mask = talloc_strdup(ctx, p+1);
1507         }
1508
1509         if (!fname_dir || !fname_mask) {
1510                 TALLOC_FREE(fname_dir);
1511                 TALLOC_FREE(fname_mask);
1512                 return NT_STATUS_NO_MEMORY;
1513         }
1514
1515         *fname_dir_out = fname_dir;
1516         *fname_mask_out = fname_mask;
1517         return NT_STATUS_OK;
1518 }
1519
1520 /****************************************************************************
1521  Reply to a search.
1522  Can be called from SMBsearch, SMBffirst or SMBfunique.
1523 ****************************************************************************/
1524
1525 void reply_search(struct smb_request *req)
1526 {
1527         connection_struct *conn = req->conn;
1528         char *path = NULL;
1529         const char *mask = NULL;
1530         char *directory = NULL;
1531         struct smb_filename *smb_fname = NULL;
1532         char *fname = NULL;
1533         off_t size;
1534         uint32 mode;
1535         struct timespec date;
1536         uint32 dirtype;
1537         unsigned int numentries = 0;
1538         unsigned int maxentries = 0;
1539         bool finished = False;
1540         const char *p;
1541         int status_len;
1542         char status[21];
1543         int dptr_num= -1;
1544         bool check_descend = False;
1545         bool expect_close = False;
1546         NTSTATUS nt_status;
1547         bool mask_contains_wcard = False;
1548         bool allow_long_path_components = (req->flags2 & FLAGS2_LONG_PATH_COMPONENTS) ? True : False;
1549         TALLOC_CTX *ctx = talloc_tos();
1550         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1551         struct dptr_struct *dirptr = NULL;
1552         struct smbd_server_connection *sconn = req->sconn;
1553
1554         START_PROFILE(SMBsearch);
1555
1556         if (req->wct < 2) {
1557                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1558                 goto out;
1559         }
1560
1561         if (lp_posix_pathnames()) {
1562                 reply_unknown_new(req, req->cmd);
1563                 goto out;
1564         }
1565
1566         /* If we were called as SMBffirst then we must expect close. */
1567         if(req->cmd == SMBffirst) {
1568                 expect_close = True;
1569         }
1570
1571         reply_outbuf(req, 1, 3);
1572         maxentries = SVAL(req->vwv+0, 0);
1573         dirtype = SVAL(req->vwv+1, 0);
1574         p = (const char *)req->buf + 1;
1575         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1576                                        &nt_status, &mask_contains_wcard);
1577         if (!NT_STATUS_IS_OK(nt_status)) {
1578                 reply_nterror(req, nt_status);
1579                 goto out;
1580         }
1581
1582         p++;
1583         status_len = SVAL(p, 0);
1584         p += 2;
1585
1586         /* dirtype &= ~FILE_ATTRIBUTE_DIRECTORY; */
1587
1588         if (status_len == 0) {
1589                 nt_status = filename_convert(ctx, conn,
1590                                              req->flags2 & FLAGS2_DFS_PATHNAMES,
1591                                              path,
1592                                              UCF_ALWAYS_ALLOW_WCARD_LCOMP,
1593                                              &mask_contains_wcard,
1594                                              &smb_fname);
1595                 if (!NT_STATUS_IS_OK(nt_status)) {
1596                         if (NT_STATUS_EQUAL(nt_status,NT_STATUS_PATH_NOT_COVERED)) {
1597                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
1598                                                 ERRSRV, ERRbadpath);
1599                                 goto out;
1600                         }
1601                         reply_nterror(req, nt_status);
1602                         goto out;
1603                 }
1604
1605                 directory = smb_fname->base_name;
1606
1607                 p = strrchr_m(directory,'/');
1608                 if ((p != NULL) && (*directory != '/')) {
1609                         mask = p + 1;
1610                         directory = talloc_strndup(ctx, directory,
1611                                                    PTR_DIFF(p, directory));
1612                 } else {
1613                         mask = directory;
1614                         directory = talloc_strdup(ctx,".");
1615                 }
1616
1617                 if (!directory) {
1618                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1619                         goto out;
1620                 }
1621
1622                 memset((char *)status,'\0',21);
1623                 SCVAL(status,0,(dirtype & 0x1F));
1624
1625                 nt_status = dptr_create(conn,
1626                                         NULL, /* req */
1627                                         NULL, /* fsp */
1628                                         directory,
1629                                         True,
1630                                         expect_close,
1631                                         req->smbpid,
1632                                         mask,
1633                                         mask_contains_wcard,
1634                                         dirtype,
1635                                         &dirptr);
1636                 if (!NT_STATUS_IS_OK(nt_status)) {
1637                         reply_nterror(req, nt_status);
1638                         goto out;
1639                 }
1640                 dptr_num = dptr_dnum(dirptr);
1641         } else {
1642                 int status_dirtype;
1643                 const char *dirpath;
1644
1645                 memcpy(status,p,21);
1646                 status_dirtype = CVAL(status,0) & 0x1F;
1647                 if (status_dirtype != (dirtype & 0x1F)) {
1648                         dirtype = status_dirtype;
1649                 }
1650
1651                 dirptr = dptr_fetch(sconn, status+12,&dptr_num);
1652                 if (!dirptr) {
1653                         goto SearchEmpty;
1654                 }
1655                 dirpath = dptr_path(sconn, dptr_num);
1656                 directory = talloc_strdup(ctx, dirpath);
1657                 if (!directory) {
1658                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1659                         goto out;
1660                 }
1661
1662                 mask = dptr_wcard(sconn, dptr_num);
1663                 if (!mask) {
1664                         goto SearchEmpty;
1665                 }
1666                 /*
1667                  * For a 'continue' search we have no string. So
1668                  * check from the initial saved string.
1669                  */
1670                 mask_contains_wcard = ms_has_wild(mask);
1671                 dirtype = dptr_attr(sconn, dptr_num);
1672         }
1673
1674         DEBUG(4,("dptr_num is %d\n",dptr_num));
1675
1676         /* Initialize per SMBsearch/SMBffirst/SMBfunique operation data */
1677         dptr_init_search_op(dirptr);
1678
1679         if ((dirtype&0x1F) == FILE_ATTRIBUTE_VOLUME) {
1680                 char buf[DIR_STRUCT_SIZE];
1681                 memcpy(buf,status,21);
1682                 if (!make_dir_struct(ctx,buf,"???????????",volume_label(ctx, SNUM(conn)),
1683                                 0,FILE_ATTRIBUTE_VOLUME,0,!allow_long_path_components)) {
1684                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1685                         goto out;
1686                 }
1687                 dptr_fill(sconn, buf+12,dptr_num);
1688                 if (dptr_zero(buf+12) && (status_len==0)) {
1689                         numentries = 1;
1690                 } else {
1691                         numentries = 0;
1692                 }
1693                 if (message_push_blob(&req->outbuf,
1694                                       data_blob_const(buf, sizeof(buf)))
1695                     == -1) {
1696                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1697                         goto out;
1698                 }
1699         } else {
1700                 unsigned int i;
1701                 size_t hdr_size = ((uint8_t *)smb_buf(req->outbuf) + 3 - req->outbuf);
1702                 size_t available_space = sconn->smb1.sessions.max_send - hdr_size;
1703
1704                 maxentries = MIN(maxentries, available_space/DIR_STRUCT_SIZE);
1705
1706                 DEBUG(8,("dirpath=<%s> dontdescend=<%s>\n",
1707                          directory,lp_dontdescend(ctx, SNUM(conn))));
1708                 if (in_list(directory, lp_dontdescend(ctx, SNUM(conn)),True)) {
1709                         check_descend = True;
1710                 }
1711
1712                 for (i=numentries;(i<maxentries) && !finished;i++) {
1713                         finished = !get_dir_entry(ctx,
1714                                                   dirptr,
1715                                                   mask,
1716                                                   dirtype,
1717                                                   &fname,
1718                                                   &size,
1719                                                   &mode,
1720                                                   &date,
1721                                                   check_descend,
1722                                                   ask_sharemode);
1723                         if (!finished) {
1724                                 char buf[DIR_STRUCT_SIZE];
1725                                 memcpy(buf,status,21);
1726                                 if (!make_dir_struct(ctx,
1727                                                 buf,
1728                                                 mask,
1729                                                 fname,
1730                                                 size,
1731                                                 mode,
1732                                                 convert_timespec_to_time_t(date),
1733                                                 !allow_long_path_components)) {
1734                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1735                                         goto out;
1736                                 }
1737                                 if (!dptr_fill(sconn, buf+12,dptr_num)) {
1738                                         break;
1739                                 }
1740                                 if (message_push_blob(&req->outbuf,
1741                                                       data_blob_const(buf, sizeof(buf)))
1742                                     == -1) {
1743                                         reply_nterror(req, NT_STATUS_NO_MEMORY);
1744                                         goto out;
1745                                 }
1746                                 numentries++;
1747                         }
1748                 }
1749         }
1750
1751   SearchEmpty:
1752
1753         /* If we were called as SMBffirst with smb_search_id == NULL
1754                 and no entries were found then return error and close dirptr
1755                 (X/Open spec) */
1756
1757         if (numentries == 0) {
1758                 dptr_close(sconn, &dptr_num);
1759         } else if(expect_close && status_len == 0) {
1760                 /* Close the dptr - we know it's gone */
1761                 dptr_close(sconn, &dptr_num);
1762         }
1763
1764         /* If we were called as SMBfunique, then we can close the dirptr now ! */
1765         if(dptr_num >= 0 && req->cmd == SMBfunique) {
1766                 dptr_close(sconn, &dptr_num);
1767         }
1768
1769         if ((numentries == 0) && !mask_contains_wcard) {
1770                 reply_botherror(req, STATUS_NO_MORE_FILES, ERRDOS, ERRnofiles);
1771                 goto out;
1772         }
1773
1774         SSVAL(req->outbuf,smb_vwv0,numentries);
1775         SSVAL(req->outbuf,smb_vwv1,3 + numentries * DIR_STRUCT_SIZE);
1776         SCVAL(smb_buf(req->outbuf),0,5);
1777         SSVAL(smb_buf(req->outbuf),1,numentries*DIR_STRUCT_SIZE);
1778
1779         /* The replies here are never long name. */
1780         SSVAL(req->outbuf, smb_flg2,
1781               SVAL(req->outbuf, smb_flg2) & (~FLAGS2_IS_LONG_NAME));
1782         if (!allow_long_path_components) {
1783                 SSVAL(req->outbuf, smb_flg2,
1784                       SVAL(req->outbuf, smb_flg2)
1785                       & (~FLAGS2_LONG_PATH_COMPONENTS));
1786         }
1787
1788         /* This SMB *always* returns ASCII names. Remove the unicode bit in flags2. */
1789         SSVAL(req->outbuf, smb_flg2,
1790               (SVAL(req->outbuf, smb_flg2) & (~FLAGS2_UNICODE_STRINGS)));
1791
1792         DEBUG(4,("%s mask=%s path=%s dtype=%d nument=%u of %u\n",
1793                 smb_fn_name(req->cmd),
1794                 mask,
1795                 directory,
1796                 dirtype,
1797                 numentries,
1798                 maxentries ));
1799  out:
1800         TALLOC_FREE(directory);
1801         TALLOC_FREE(smb_fname);
1802         END_PROFILE(SMBsearch);
1803         return;
1804 }
1805
1806 /****************************************************************************
1807  Reply to a fclose (stop directory search).
1808 ****************************************************************************/
1809
1810 void reply_fclose(struct smb_request *req)
1811 {
1812         int status_len;
1813         char status[21];
1814         int dptr_num= -2;
1815         const char *p;
1816         char *path = NULL;
1817         NTSTATUS err;
1818         bool path_contains_wcard = False;
1819         TALLOC_CTX *ctx = talloc_tos();
1820         struct smbd_server_connection *sconn = req->sconn;
1821
1822         START_PROFILE(SMBfclose);
1823
1824         if (lp_posix_pathnames()) {
1825                 reply_unknown_new(req, req->cmd);
1826                 END_PROFILE(SMBfclose);
1827                 return;
1828         }
1829
1830         p = (const char *)req->buf + 1;
1831         p += srvstr_get_path_req_wcard(ctx, req, &path, p, STR_TERMINATE,
1832                                        &err, &path_contains_wcard);
1833         if (!NT_STATUS_IS_OK(err)) {
1834                 reply_nterror(req, err);
1835                 END_PROFILE(SMBfclose);
1836                 return;
1837         }
1838         p++;
1839         status_len = SVAL(p,0);
1840         p += 2;
1841
1842         if (status_len == 0) {
1843                 reply_force_doserror(req, ERRSRV, ERRsrverror);
1844                 END_PROFILE(SMBfclose);
1845                 return;
1846         }
1847
1848         memcpy(status,p,21);
1849
1850         if(dptr_fetch(sconn, status+12,&dptr_num)) {
1851                 /*  Close the dptr - we know it's gone */
1852                 dptr_close(sconn, &dptr_num);
1853         }
1854
1855         reply_outbuf(req, 1, 0);
1856         SSVAL(req->outbuf,smb_vwv0,0);
1857
1858         DEBUG(3,("search close\n"));
1859
1860         END_PROFILE(SMBfclose);
1861         return;
1862 }
1863
1864 /****************************************************************************
1865  Reply to an open.
1866 ****************************************************************************/
1867
1868 void reply_open(struct smb_request *req)
1869 {
1870         connection_struct *conn = req->conn;
1871         struct smb_filename *smb_fname = NULL;
1872         char *fname = NULL;
1873         uint32 fattr=0;
1874         off_t size = 0;
1875         time_t mtime=0;
1876         int info;
1877         files_struct *fsp;
1878         int oplock_request;
1879         int deny_mode;
1880         uint32 dos_attr;
1881         uint32 access_mask;
1882         uint32 share_mode;
1883         uint32 create_disposition;
1884         uint32 create_options = 0;
1885         uint32_t private_flags = 0;
1886         NTSTATUS status;
1887         bool ask_sharemode = lp_parm_bool(SNUM(conn), "smbd", "search ask sharemode", true);
1888         TALLOC_CTX *ctx = talloc_tos();
1889
1890         START_PROFILE(SMBopen);
1891
1892         if (req->wct < 2) {
1893                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
1894                 goto out;
1895         }
1896
1897         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
1898         deny_mode = SVAL(req->vwv+0, 0);
1899         dos_attr = SVAL(req->vwv+1, 0);
1900
1901         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf+1,
1902                             STR_TERMINATE, &status);
1903         if (!NT_STATUS_IS_OK(status)) {
1904                 reply_nterror(req, status);
1905                 goto out;
1906         }
1907
1908         if (!map_open_params_to_ntcreate(fname, deny_mode,
1909                                          OPENX_FILE_EXISTS_OPEN, &access_mask,
1910                                          &share_mode, &create_disposition,
1911                                          &create_options, &private_flags)) {
1912                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
1913                 goto out;
1914         }
1915
1916         status = filename_convert(ctx,
1917                                 conn,
1918                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
1919                                 fname,
1920                                 UCF_PREP_CREATEFILE,
1921                                 NULL,
1922                                 &smb_fname);
1923         if (!NT_STATUS_IS_OK(status)) {
1924                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
1925                         reply_botherror(req,
1926                                         NT_STATUS_PATH_NOT_COVERED,
1927                                         ERRSRV, ERRbadpath);
1928                         goto out;
1929                 }
1930                 reply_nterror(req, status);
1931                 goto out;
1932         }
1933
1934         status = SMB_VFS_CREATE_FILE(
1935                 conn,                                   /* conn */
1936                 req,                                    /* req */
1937                 0,                                      /* root_dir_fid */
1938                 smb_fname,                              /* fname */
1939                 access_mask,                            /* access_mask */
1940                 share_mode,                             /* share_access */
1941                 create_disposition,                     /* create_disposition*/
1942                 create_options,                         /* create_options */
1943                 dos_attr,                               /* file_attributes */
1944                 oplock_request,                         /* oplock_request */
1945                 0,                                      /* allocation_size */
1946                 private_flags,
1947                 NULL,                                   /* sd */
1948                 NULL,                                   /* ea_list */
1949                 &fsp,                                   /* result */
1950                 &info);                                 /* pinfo */
1951
1952         if (!NT_STATUS_IS_OK(status)) {
1953                 if (open_was_deferred(req->sconn, req->mid)) {
1954                         /* We have re-scheduled this call. */
1955                         goto out;
1956                 }
1957                 reply_openerror(req, status);
1958                 goto out;
1959         }
1960
1961         size = smb_fname->st.st_ex_size;
1962         fattr = dos_mode(conn, smb_fname);
1963
1964         /* Deal with other possible opens having a modified
1965            write time. JRA. */
1966         if (ask_sharemode) {
1967                 struct timespec write_time_ts;
1968
1969                 ZERO_STRUCT(write_time_ts);
1970                 get_file_infos(fsp->file_id, 0, NULL, &write_time_ts);
1971                 if (!null_timespec(write_time_ts)) {
1972                         update_stat_ex_mtime(&smb_fname->st, write_time_ts);
1973                 }
1974         }
1975
1976         mtime = convert_timespec_to_time_t(smb_fname->st.st_ex_mtime);
1977
1978         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
1979                 DEBUG(3,("attempt to open a directory %s\n",
1980                          fsp_str_dbg(fsp)));
1981                 close_file(req, fsp, ERROR_CLOSE);
1982                 reply_botherror(req, NT_STATUS_ACCESS_DENIED,
1983                         ERRDOS, ERRnoaccess);
1984                 goto out;
1985         }
1986
1987         reply_outbuf(req, 7, 0);
1988         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
1989         SSVAL(req->outbuf,smb_vwv1,fattr);
1990         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
1991                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime & ~1);
1992         } else {
1993                 srv_put_dos_date3((char *)req->outbuf,smb_vwv2,mtime);
1994         }
1995         SIVAL(req->outbuf,smb_vwv4,(uint32)size);
1996         SSVAL(req->outbuf,smb_vwv6,deny_mode);
1997
1998         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
1999                 SCVAL(req->outbuf,smb_flg,
2000                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2001         }
2002
2003         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2004                 SCVAL(req->outbuf,smb_flg,
2005                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2006         }
2007  out:
2008         TALLOC_FREE(smb_fname);
2009         END_PROFILE(SMBopen);
2010         return;
2011 }
2012
2013 /****************************************************************************
2014  Reply to an open and X.
2015 ****************************************************************************/
2016
2017 void reply_open_and_X(struct smb_request *req)
2018 {
2019         connection_struct *conn = req->conn;
2020         struct smb_filename *smb_fname = NULL;
2021         char *fname = NULL;
2022         uint16 open_flags;
2023         int deny_mode;
2024         uint32 smb_attr;
2025         /* Breakout the oplock request bits so we can set the
2026                 reply bits separately. */
2027         int ex_oplock_request;
2028         int core_oplock_request;
2029         int oplock_request;
2030 #if 0
2031         int smb_sattr = SVAL(req->vwv+4, 0);
2032         uint32 smb_time = make_unix_date3(req->vwv+6);
2033 #endif
2034         int smb_ofun;
2035         uint32 fattr=0;
2036         int mtime=0;
2037         int smb_action = 0;
2038         files_struct *fsp;
2039         NTSTATUS status;
2040         uint64_t allocation_size;
2041         ssize_t retval = -1;
2042         uint32 access_mask;
2043         uint32 share_mode;
2044         uint32 create_disposition;
2045         uint32 create_options = 0;
2046         uint32_t private_flags = 0;
2047         TALLOC_CTX *ctx = talloc_tos();
2048
2049         START_PROFILE(SMBopenX);
2050
2051         if (req->wct < 15) {
2052                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2053                 goto out;
2054         }
2055
2056         open_flags = SVAL(req->vwv+2, 0);
2057         deny_mode = SVAL(req->vwv+3, 0);
2058         smb_attr = SVAL(req->vwv+5, 0);
2059         ex_oplock_request = EXTENDED_OPLOCK_REQUEST(req->inbuf);
2060         core_oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2061         oplock_request = ex_oplock_request | core_oplock_request;
2062         smb_ofun = SVAL(req->vwv+8, 0);
2063         allocation_size = (uint64_t)IVAL(req->vwv+9, 0);
2064
2065         /* If it's an IPC, pass off the pipe handler. */
2066         if (IS_IPC(conn)) {
2067                 if (lp_nt_pipe_support()) {
2068                         reply_open_pipe_and_X(conn, req);
2069                 } else {
2070                         reply_nterror(req, NT_STATUS_NETWORK_ACCESS_DENIED);
2071                 }
2072                 goto out;
2073         }
2074
2075         /* XXXX we need to handle passed times, sattr and flags */
2076         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf,
2077                         STR_TERMINATE, &status);
2078         if (!NT_STATUS_IS_OK(status)) {
2079                 reply_nterror(req, status);
2080                 goto out;
2081         }
2082
2083         if (!map_open_params_to_ntcreate(fname, deny_mode,
2084                                          smb_ofun,
2085                                          &access_mask, &share_mode,
2086                                          &create_disposition,
2087                                          &create_options,
2088                                          &private_flags)) {
2089                 reply_force_doserror(req, ERRDOS, ERRbadaccess);
2090                 goto out;
2091         }
2092
2093         status = filename_convert(ctx,
2094                                 conn,
2095                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2096                                 fname,
2097                                 UCF_PREP_CREATEFILE,
2098                                 NULL,
2099                                 &smb_fname);
2100         if (!NT_STATUS_IS_OK(status)) {
2101                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2102                         reply_botherror(req,
2103                                         NT_STATUS_PATH_NOT_COVERED,
2104                                         ERRSRV, ERRbadpath);
2105                         goto out;
2106                 }
2107                 reply_nterror(req, status);
2108                 goto out;
2109         }
2110
2111         status = SMB_VFS_CREATE_FILE(
2112                 conn,                                   /* conn */
2113                 req,                                    /* req */
2114                 0,                                      /* root_dir_fid */
2115                 smb_fname,                              /* fname */
2116                 access_mask,                            /* access_mask */
2117                 share_mode,                             /* share_access */
2118                 create_disposition,                     /* create_disposition*/
2119                 create_options,                         /* create_options */
2120                 smb_attr,                               /* file_attributes */
2121                 oplock_request,                         /* oplock_request */
2122                 0,                                      /* allocation_size */
2123                 private_flags,
2124                 NULL,                                   /* sd */
2125                 NULL,                                   /* ea_list */
2126                 &fsp,                                   /* result */
2127                 &smb_action);                           /* pinfo */
2128
2129         if (!NT_STATUS_IS_OK(status)) {
2130                 if (open_was_deferred(req->sconn, req->mid)) {
2131                         /* We have re-scheduled this call. */
2132                         goto out;
2133                 }
2134                 reply_openerror(req, status);
2135                 goto out;
2136         }
2137
2138         /* Setting the "size" field in vwv9 and vwv10 causes the file to be set to this size,
2139            if the file is truncated or created. */
2140         if (((smb_action == FILE_WAS_CREATED) || (smb_action == FILE_WAS_OVERWRITTEN)) && allocation_size) {
2141                 fsp->initial_allocation_size = smb_roundup(fsp->conn, allocation_size);
2142                 if (vfs_allocate_file_space(fsp, fsp->initial_allocation_size) == -1) {
2143                         close_file(req, fsp, ERROR_CLOSE);
2144                         reply_nterror(req, NT_STATUS_DISK_FULL);
2145                         goto out;
2146                 }
2147                 retval = vfs_set_filelen(fsp, (off_t)allocation_size);
2148                 if (retval < 0) {
2149                         close_file(req, fsp, ERROR_CLOSE);
2150                         reply_nterror(req, NT_STATUS_DISK_FULL);
2151                         goto out;
2152                 }
2153                 status = vfs_stat_fsp(fsp);
2154                 if (!NT_STATUS_IS_OK(status)) {
2155                         close_file(req, fsp, ERROR_CLOSE);
2156                         reply_nterror(req, status);
2157                         goto out;
2158                 }
2159         }
2160
2161         fattr = dos_mode(conn, fsp->fsp_name);
2162         mtime = convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime);
2163         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2164                 close_file(req, fsp, ERROR_CLOSE);
2165                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
2166                 goto out;
2167         }
2168
2169         /* If the caller set the extended oplock request bit
2170                 and we granted one (by whatever means) - set the
2171                 correct bit for extended oplock reply.
2172         */
2173
2174         if (ex_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2175                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2176         }
2177
2178         if(ex_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2179                 smb_action |= EXTENDED_OPLOCK_GRANTED;
2180         }
2181
2182         /* If the caller set the core oplock request bit
2183                 and we granted one (by whatever means) - set the
2184                 correct bit for core oplock reply.
2185         */
2186
2187         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2188                 reply_outbuf(req, 19, 0);
2189         } else {
2190                 reply_outbuf(req, 15, 0);
2191         }
2192
2193         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2194         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2195
2196         if (core_oplock_request && lp_fake_oplocks(SNUM(conn))) {
2197                 SCVAL(req->outbuf, smb_flg,
2198                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2199         }
2200
2201         if(core_oplock_request && EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2202                 SCVAL(req->outbuf, smb_flg,
2203                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2204         }
2205
2206         SSVAL(req->outbuf,smb_vwv2,fsp->fnum);
2207         SSVAL(req->outbuf,smb_vwv3,fattr);
2208         if(lp_dos_filetime_resolution(SNUM(conn)) ) {
2209                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime & ~1);
2210         } else {
2211                 srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
2212         }
2213         SIVAL(req->outbuf,smb_vwv6,(uint32)fsp->fsp_name->st.st_ex_size);
2214         SSVAL(req->outbuf,smb_vwv8,GET_OPENX_MODE(deny_mode));
2215         SSVAL(req->outbuf,smb_vwv11,smb_action);
2216
2217         if (open_flags & EXTENDED_RESPONSE_REQUIRED) {
2218                 SIVAL(req->outbuf, smb_vwv15, SEC_STD_ALL);
2219         }
2220
2221  out:
2222         TALLOC_FREE(smb_fname);
2223         END_PROFILE(SMBopenX);
2224         return;
2225 }
2226
2227 /****************************************************************************
2228  Reply to a SMBulogoffX.
2229 ****************************************************************************/
2230
2231 void reply_ulogoffX(struct smb_request *req)
2232 {
2233         struct smbd_server_connection *sconn = req->sconn;
2234         struct user_struct *vuser;
2235         struct smbXsrv_session *session = NULL;
2236         NTSTATUS status;
2237
2238         START_PROFILE(SMBulogoffX);
2239
2240         vuser = get_valid_user_struct(sconn, req->vuid);
2241
2242         if(vuser == NULL) {
2243                 DEBUG(3,("ulogoff, vuser id %llu does not map to user.\n",
2244                          (unsigned long long)req->vuid));
2245
2246                 req->vuid = UID_FIELD_INVALID;
2247                 reply_force_doserror(req, ERRSRV, ERRbaduid);
2248                 END_PROFILE(SMBulogoffX);
2249                 return;
2250         }
2251
2252         session = vuser->session;
2253         vuser = NULL;
2254
2255         /*
2256          * TODO: cancel all outstanding requests on the session
2257          */
2258         status = smbXsrv_session_logoff(session);
2259         if (!NT_STATUS_IS_OK(status)) {
2260                 DEBUG(0, ("reply_ulogoff: "
2261                           "smbXsrv_session_logoff() failed: %s\n",
2262                           nt_errstr(status)));
2263                 /*
2264                  * If we hit this case, there is something completely
2265                  * wrong, so we better disconnect the transport connection.
2266                  */
2267                 END_PROFILE(SMBulogoffX);
2268                 exit_server(__location__ ": smbXsrv_session_logoff failed");
2269                 return;
2270         }
2271
2272         TALLOC_FREE(session);
2273
2274         reply_outbuf(req, 2, 0);
2275         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
2276         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
2277
2278         DEBUG(3, ("ulogoffX vuid=%llu\n",
2279                   (unsigned long long)req->vuid));
2280
2281         END_PROFILE(SMBulogoffX);
2282         req->vuid = UID_FIELD_INVALID;
2283 }
2284
2285 /****************************************************************************
2286  Reply to a mknew or a create.
2287 ****************************************************************************/
2288
2289 void reply_mknew(struct smb_request *req)
2290 {
2291         connection_struct *conn = req->conn;
2292         struct smb_filename *smb_fname = NULL;
2293         char *fname = NULL;
2294         uint32 fattr = 0;
2295         struct smb_file_time ft;
2296         files_struct *fsp;
2297         int oplock_request = 0;
2298         NTSTATUS status;
2299         uint32 access_mask = FILE_GENERIC_READ | FILE_GENERIC_WRITE;
2300         uint32 share_mode = FILE_SHARE_READ|FILE_SHARE_WRITE;
2301         uint32 create_disposition;
2302         uint32 create_options = 0;
2303         TALLOC_CTX *ctx = talloc_tos();
2304
2305         START_PROFILE(SMBcreate);
2306         ZERO_STRUCT(ft);
2307
2308         if (req->wct < 3) {
2309                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2310                 goto out;
2311         }
2312
2313         fattr = SVAL(req->vwv+0, 0);
2314         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2315
2316         /* mtime. */
2317         ft.mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+1));
2318
2319         srvstr_get_path_req(ctx, req, &fname, (const char *)req->buf + 1,
2320                             STR_TERMINATE, &status);
2321         if (!NT_STATUS_IS_OK(status)) {
2322                 reply_nterror(req, status);
2323                 goto out;
2324         }
2325
2326         status = filename_convert(ctx,
2327                                 conn,
2328                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2329                                 fname,
2330                                 UCF_PREP_CREATEFILE,
2331                                 NULL,
2332                                 &smb_fname);
2333         if (!NT_STATUS_IS_OK(status)) {
2334                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2335                         reply_botherror(req,
2336                                         NT_STATUS_PATH_NOT_COVERED,
2337                                         ERRSRV, ERRbadpath);
2338                         goto out;
2339                 }
2340                 reply_nterror(req, status);
2341                 goto out;
2342         }
2343
2344         if (fattr & FILE_ATTRIBUTE_VOLUME) {
2345                 DEBUG(0,("Attempt to create file (%s) with volid set - "
2346                          "please report this\n",
2347                          smb_fname_str_dbg(smb_fname)));
2348         }
2349
2350         if(req->cmd == SMBmknew) {
2351                 /* We should fail if file exists. */
2352                 create_disposition = FILE_CREATE;
2353         } else {
2354                 /* Create if file doesn't exist, truncate if it does. */
2355                 create_disposition = FILE_OVERWRITE_IF;
2356         }
2357
2358         status = SMB_VFS_CREATE_FILE(
2359                 conn,                                   /* conn */
2360                 req,                                    /* req */
2361                 0,                                      /* root_dir_fid */
2362                 smb_fname,                              /* fname */
2363                 access_mask,                            /* access_mask */
2364                 share_mode,                             /* share_access */
2365                 create_disposition,                     /* create_disposition*/
2366                 create_options,                         /* create_options */
2367                 fattr,                                  /* file_attributes */
2368                 oplock_request,                         /* oplock_request */
2369                 0,                                      /* allocation_size */
2370                 0,                                      /* private_flags */
2371                 NULL,                                   /* sd */
2372                 NULL,                                   /* ea_list */
2373                 &fsp,                                   /* result */
2374                 NULL);                                  /* pinfo */
2375
2376         if (!NT_STATUS_IS_OK(status)) {
2377                 if (open_was_deferred(req->sconn, req->mid)) {
2378                         /* We have re-scheduled this call. */
2379                         goto out;
2380                 }
2381                 reply_openerror(req, status);
2382                 goto out;
2383         }
2384
2385         ft.atime = smb_fname->st.st_ex_atime; /* atime. */
2386         status = smb_set_file_time(conn, fsp, smb_fname, &ft, true);
2387         if (!NT_STATUS_IS_OK(status)) {
2388                 END_PROFILE(SMBcreate);
2389                 goto out;
2390         }
2391
2392         reply_outbuf(req, 1, 0);
2393         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2394
2395         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2396                 SCVAL(req->outbuf,smb_flg,
2397                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2398         }
2399
2400         if(EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2401                 SCVAL(req->outbuf,smb_flg,
2402                                 CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2403         }
2404
2405         DEBUG(2, ("reply_mknew: file %s\n", smb_fname_str_dbg(smb_fname)));
2406         DEBUG(3, ("reply_mknew %s fd=%d dmode=0x%x\n",
2407                   smb_fname_str_dbg(smb_fname), fsp->fh->fd,
2408                   (unsigned int)fattr));
2409
2410  out:
2411         TALLOC_FREE(smb_fname);
2412         END_PROFILE(SMBcreate);
2413         return;
2414 }
2415
2416 /****************************************************************************
2417  Reply to a create temporary file.
2418 ****************************************************************************/
2419
2420 void reply_ctemp(struct smb_request *req)
2421 {
2422         connection_struct *conn = req->conn;
2423         struct smb_filename *smb_fname = NULL;
2424         char *wire_name = NULL;
2425         char *fname = NULL;
2426         uint32 fattr;
2427         files_struct *fsp;
2428         int oplock_request;
2429         char *s;
2430         NTSTATUS status;
2431         int i;
2432         TALLOC_CTX *ctx = talloc_tos();
2433
2434         START_PROFILE(SMBctemp);
2435
2436         if (req->wct < 3) {
2437                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2438                 goto out;
2439         }
2440
2441         fattr = SVAL(req->vwv+0, 0);
2442         oplock_request = CORE_OPLOCK_REQUEST(req->inbuf);
2443
2444         srvstr_get_path_req(ctx, req, &wire_name, (const char *)req->buf+1,
2445                             STR_TERMINATE, &status);
2446         if (!NT_STATUS_IS_OK(status)) {
2447                 reply_nterror(req, status);
2448                 goto out;
2449         }
2450
2451         for (i = 0; i < 10; i++) {
2452                 if (*wire_name) {
2453                         fname = talloc_asprintf(ctx,
2454                                         "%s/TMP%s",
2455                                         wire_name,
2456                                         generate_random_str_list(ctx, 5, "0123456789"));
2457                 } else {
2458                         fname = talloc_asprintf(ctx,
2459                                         "TMP%s",
2460                                         generate_random_str_list(ctx, 5, "0123456789"));
2461                 }
2462
2463                 if (!fname) {
2464                         reply_nterror(req, NT_STATUS_NO_MEMORY);
2465                         goto out;
2466                 }
2467
2468                 status = filename_convert(ctx, conn,
2469                                 req->flags2 & FLAGS2_DFS_PATHNAMES,
2470                                 fname,
2471                                 UCF_PREP_CREATEFILE,
2472                                 NULL,
2473                                 &smb_fname);
2474                 if (!NT_STATUS_IS_OK(status)) {
2475                         if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2476                                 reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2477                                         ERRSRV, ERRbadpath);
2478                                 goto out;
2479                         }
2480                         reply_nterror(req, status);
2481                         goto out;
2482                 }
2483
2484                 /* Create the file. */
2485                 status = SMB_VFS_CREATE_FILE(
2486                         conn,                                   /* conn */
2487                         req,                                    /* req */
2488                         0,                                      /* root_dir_fid */
2489                         smb_fname,                              /* fname */
2490                         FILE_GENERIC_READ | FILE_GENERIC_WRITE, /* access_mask */
2491                         FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
2492                         FILE_CREATE,                            /* create_disposition*/
2493                         0,                                      /* create_options */
2494                         fattr,                                  /* file_attributes */
2495                         oplock_request,                         /* oplock_request */
2496                         0,                                      /* allocation_size */
2497                         0,                                      /* private_flags */
2498                         NULL,                                   /* sd */
2499                         NULL,                                   /* ea_list */
2500                         &fsp,                                   /* result */
2501                         NULL);                                  /* pinfo */
2502
2503                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_COLLISION)) {
2504                         TALLOC_FREE(fname);
2505                         TALLOC_FREE(smb_fname);
2506                         continue;
2507                 }
2508
2509                 if (!NT_STATUS_IS_OK(status)) {
2510                         if (open_was_deferred(req->sconn, req->mid)) {
2511                                 /* We have re-scheduled this call. */
2512                                 goto out;
2513                         }
2514                         reply_openerror(req, status);
2515                         goto out;
2516                 }
2517
2518                 break;
2519         }
2520
2521         if (i == 10) {
2522                 /* Collision after 10 times... */
2523                 reply_nterror(req, status);
2524                 goto out;
2525         }
2526
2527         reply_outbuf(req, 1, 0);
2528         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
2529
2530         /* the returned filename is relative to the directory */
2531         s = strrchr_m(fsp->fsp_name->base_name, '/');
2532         if (!s) {
2533                 s = fsp->fsp_name->base_name;
2534         } else {
2535                 s++;
2536         }
2537
2538 #if 0
2539         /* Tested vs W2K3 - this doesn't seem to be here - null terminated filename is the only
2540            thing in the byte section. JRA */
2541         SSVALS(p, 0, -1); /* what is this? not in spec */
2542 #endif
2543         if (message_push_string(&req->outbuf, s, STR_ASCII|STR_TERMINATE)
2544             == -1) {
2545                 reply_nterror(req, NT_STATUS_NO_MEMORY);
2546                 goto out;
2547         }
2548
2549         if (oplock_request && lp_fake_oplocks(SNUM(conn))) {
2550                 SCVAL(req->outbuf, smb_flg,
2551                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2552         }
2553
2554         if (EXCLUSIVE_OPLOCK_TYPE(fsp->oplock_type)) {
2555                 SCVAL(req->outbuf, smb_flg,
2556                       CVAL(req->outbuf,smb_flg)|CORE_OPLOCK_GRANTED);
2557         }
2558
2559         DEBUG(2, ("reply_ctemp: created temp file %s\n", fsp_str_dbg(fsp)));
2560         DEBUG(3, ("reply_ctemp %s fd=%d umode=0%o\n", fsp_str_dbg(fsp),
2561                     fsp->fh->fd, (unsigned int)smb_fname->st.st_ex_mode));
2562  out:
2563         TALLOC_FREE(smb_fname);
2564         TALLOC_FREE(wire_name);
2565         END_PROFILE(SMBctemp);
2566         return;
2567 }
2568
2569 /*******************************************************************
2570  Check if a user is allowed to rename a file.
2571 ********************************************************************/
2572
2573 static NTSTATUS can_rename(connection_struct *conn, files_struct *fsp,
2574                         uint16 dirtype)
2575 {
2576         if (!CAN_WRITE(conn)) {
2577                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2578         }
2579
2580         if ((dirtype & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) !=
2581                         (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2582                 /* Only bother to read the DOS attribute if we might deny the
2583                    rename on the grounds of attribute missmatch. */
2584                 uint32_t fmode = dos_mode(conn, fsp->fsp_name);
2585                 if ((fmode & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM)) {
2586                         return NT_STATUS_NO_SUCH_FILE;
2587                 }
2588         }
2589
2590         if (S_ISDIR(fsp->fsp_name->st.st_ex_mode)) {
2591                 if (fsp->posix_open) {
2592                         return NT_STATUS_OK;
2593                 }
2594
2595                 /* If no pathnames are open below this
2596                    directory, allow the rename. */
2597
2598                 if (file_find_subpath(fsp)) {
2599                         return NT_STATUS_ACCESS_DENIED;
2600                 }
2601                 return NT_STATUS_OK;
2602         }
2603
2604         if (fsp->access_mask & (DELETE_ACCESS|FILE_WRITE_ATTRIBUTES)) {
2605                 return NT_STATUS_OK;
2606         }
2607
2608         return NT_STATUS_ACCESS_DENIED;
2609 }
2610
2611 /*******************************************************************
2612  * unlink a file with all relevant access checks
2613  *******************************************************************/
2614
2615 static NTSTATUS do_unlink(connection_struct *conn,
2616                         struct smb_request *req,
2617                         struct smb_filename *smb_fname,
2618                         uint32 dirtype)
2619 {
2620         uint32 fattr;
2621         files_struct *fsp;
2622         uint32 dirtype_orig = dirtype;
2623         NTSTATUS status;
2624         int ret;
2625         bool posix_paths = lp_posix_pathnames();
2626
2627         DEBUG(10,("do_unlink: %s, dirtype = %d\n",
2628                   smb_fname_str_dbg(smb_fname),
2629                   dirtype));
2630
2631         if (!CAN_WRITE(conn)) {
2632                 return NT_STATUS_MEDIA_WRITE_PROTECTED;
2633         }
2634
2635         if (posix_paths) {
2636                 ret = SMB_VFS_LSTAT(conn, smb_fname);
2637         } else {
2638                 ret = SMB_VFS_STAT(conn, smb_fname);
2639         }
2640         if (ret != 0) {
2641                 return map_nt_error_from_unix(errno);
2642         }
2643
2644         fattr = dos_mode(conn, smb_fname);
2645
2646         if (dirtype & FILE_ATTRIBUTE_NORMAL) {
2647                 dirtype = FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY;
2648         }
2649
2650         dirtype &= (FILE_ATTRIBUTE_DIRECTORY|FILE_ATTRIBUTE_ARCHIVE|FILE_ATTRIBUTE_READONLY|FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
2651         if (!dirtype) {
2652                 return NT_STATUS_NO_SUCH_FILE;
2653         }
2654
2655         if (!dir_check_ftype(fattr, dirtype)) {
2656                 if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2657                         return NT_STATUS_FILE_IS_A_DIRECTORY;
2658                 }
2659                 return NT_STATUS_NO_SUCH_FILE;
2660         }
2661
2662         if (dirtype_orig & 0x8000) {
2663                 /* These will never be set for POSIX. */
2664                 return NT_STATUS_NO_SUCH_FILE;
2665         }
2666
2667 #if 0
2668         if ((fattr & dirtype) & FILE_ATTRIBUTE_DIRECTORY) {
2669                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2670         }
2671
2672         if ((fattr & ~dirtype) & (FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM)) {
2673                 return NT_STATUS_NO_SUCH_FILE;
2674         }
2675
2676         if (dirtype & 0xFF00) {
2677                 /* These will never be set for POSIX. */
2678                 return NT_STATUS_NO_SUCH_FILE;
2679         }
2680
2681         dirtype &= 0xFF;
2682         if (!dirtype) {
2683                 return NT_STATUS_NO_SUCH_FILE;
2684         }
2685
2686         /* Can't delete a directory. */
2687         if (fattr & FILE_ATTRIBUTE_DIRECTORY) {
2688                 return NT_STATUS_FILE_IS_A_DIRECTORY;
2689         }
2690 #endif
2691
2692 #if 0 /* JRATEST */
2693         else if (dirtype & FILE_ATTRIBUTE_DIRECTORY) /* Asked for a directory and it isn't. */
2694                 return NT_STATUS_OBJECT_NAME_INVALID;
2695 #endif /* JRATEST */
2696
2697         /* On open checks the open itself will check the share mode, so
2698            don't do it here as we'll get it wrong. */
2699
2700         status = SMB_VFS_CREATE_FILE
2701                 (conn,                  /* conn */
2702                  req,                   /* req */
2703                  0,                     /* root_dir_fid */
2704                  smb_fname,             /* fname */
2705                  DELETE_ACCESS,         /* access_mask */
2706                  FILE_SHARE_NONE,       /* share_access */
2707                  FILE_OPEN,             /* create_disposition*/
2708                  FILE_NON_DIRECTORY_FILE, /* create_options */
2709                                         /* file_attributes */
2710                  posix_paths ? FILE_FLAG_POSIX_SEMANTICS|0777 :
2711                                 FILE_ATTRIBUTE_NORMAL,
2712                  0,                     /* oplock_request */
2713                  0,                     /* allocation_size */
2714                  0,                     /* private_flags */
2715                  NULL,                  /* sd */
2716                  NULL,                  /* ea_list */
2717                  &fsp,                  /* result */
2718                  NULL);                 /* pinfo */
2719
2720         if (!NT_STATUS_IS_OK(status)) {
2721                 DEBUG(10, ("SMB_VFS_CREATEFILE failed: %s\n",
2722                            nt_errstr(status)));
2723                 return status;
2724         }
2725
2726         status = can_set_delete_on_close(fsp, fattr);
2727         if (!NT_STATUS_IS_OK(status)) {
2728                 DEBUG(10, ("do_unlink can_set_delete_on_close for file %s - "
2729                         "(%s)\n",
2730                         smb_fname_str_dbg(smb_fname),
2731                         nt_errstr(status)));
2732                 close_file(req, fsp, NORMAL_CLOSE);
2733                 return status;
2734         }
2735
2736         /* The set is across all open files on this dev/inode pair. */
2737         if (!set_delete_on_close(fsp, True,
2738                                 conn->session_info->security_token,
2739                                 conn->session_info->unix_token)) {
2740                 close_file(req, fsp, NORMAL_CLOSE);
2741                 return NT_STATUS_ACCESS_DENIED;
2742         }
2743
2744         return close_file(req, fsp, NORMAL_CLOSE);
2745 }
2746
2747 /****************************************************************************
2748  The guts of the unlink command, split out so it may be called by the NT SMB
2749  code.
2750 ****************************************************************************/
2751
2752 NTSTATUS unlink_internals(connection_struct *conn, struct smb_request *req,
2753                           uint32 dirtype, struct smb_filename *smb_fname,
2754                           bool has_wild)
2755 {
2756         char *fname_dir = NULL;
2757         char *fname_mask = NULL;
2758         int count=0;
2759         NTSTATUS status = NT_STATUS_OK;
2760         TALLOC_CTX *ctx = talloc_tos();
2761
2762         /* Split up the directory from the filename/mask. */
2763         status = split_fname_dir_mask(ctx, smb_fname->base_name,
2764                                       &fname_dir, &fname_mask);
2765         if (!NT_STATUS_IS_OK(status)) {
2766                 goto out;
2767         }
2768
2769         /*
2770          * We should only check the mangled cache
2771          * here if unix_convert failed. This means
2772          * that the path in 'mask' doesn't exist
2773          * on the file system and so we need to look
2774          * for a possible mangle. This patch from
2775          * Tine Smukavec <valentin.smukavec@hermes.si>.
2776          */
2777
2778         if (!VALID_STAT(smb_fname->st) &&
2779             mangle_is_mangled(fname_mask, conn->params)) {
2780                 char *new_mask = NULL;
2781                 mangle_lookup_name_from_8_3(ctx, fname_mask,
2782                                             &new_mask, conn->params);
2783                 if (new_mask) {
2784                         TALLOC_FREE(fname_mask);
2785                         fname_mask = new_mask;
2786                 }
2787         }
2788
2789         if (!has_wild) {
2790
2791                 /*
2792                  * Only one file needs to be unlinked. Append the mask back
2793                  * onto the directory.
2794                  */
2795                 TALLOC_FREE(smb_fname->base_name);
2796                 if (ISDOT(fname_dir)) {
2797                         /* Ensure we use canonical names on open. */
2798                         smb_fname->base_name = talloc_asprintf(smb_fname,
2799                                                         "%s",
2800                                                         fname_mask);
2801                 } else {
2802                         smb_fname->base_name = talloc_asprintf(smb_fname,
2803                                                         "%s/%s",
2804                                                         fname_dir,
2805                                                         fname_mask);
2806                 }
2807                 if (!smb_fname->base_name) {
2808                         status = NT_STATUS_NO_MEMORY;
2809                         goto out;
2810                 }
2811                 if (dirtype == 0) {
2812                         dirtype = FILE_ATTRIBUTE_NORMAL;
2813                 }
2814
2815                 status = check_name(conn, smb_fname->base_name);
2816                 if (!NT_STATUS_IS_OK(status)) {
2817                         goto out;
2818                 }
2819
2820                 status = do_unlink(conn, req, smb_fname, dirtype);
2821                 if (!NT_STATUS_IS_OK(status)) {
2822                         goto out;
2823                 }
2824
2825                 count++;
2826         } else {
2827                 struct smb_Dir *dir_hnd = NULL;
2828                 long offset = 0;
2829                 const char *dname = NULL;
2830                 char *talloced = NULL;
2831
2832                 if ((dirtype & SAMBA_ATTRIBUTES_MASK) == FILE_ATTRIBUTE_DIRECTORY) {
2833                         status = NT_STATUS_OBJECT_NAME_INVALID;
2834                         goto out;
2835                 }
2836
2837                 if (strequal(fname_mask,"????????.???")) {
2838                         TALLOC_FREE(fname_mask);
2839                         fname_mask = talloc_strdup(ctx, "*");
2840                         if (!fname_mask) {
2841                                 status = NT_STATUS_NO_MEMORY;
2842                                 goto out;
2843                         }
2844                 }
2845
2846                 status = check_name(conn, fname_dir);
2847                 if (!NT_STATUS_IS_OK(status)) {
2848                         goto out;
2849                 }
2850
2851                 dir_hnd = OpenDir(talloc_tos(), conn, fname_dir, fname_mask,
2852                                   dirtype);
2853                 if (dir_hnd == NULL) {
2854                         status = map_nt_error_from_unix(errno);
2855                         goto out;
2856                 }
2857
2858                 /* XXXX the CIFS spec says that if bit0 of the flags2 field is set then
2859                    the pattern matches against the long name, otherwise the short name
2860                    We don't implement this yet XXXX
2861                 */
2862
2863                 status = NT_STATUS_NO_SUCH_FILE;
2864
2865                 while ((dname = ReadDirName(dir_hnd, &offset,
2866                                             &smb_fname->st, &talloced))) {
2867                         TALLOC_CTX *frame = talloc_stackframe();
2868
2869                         if (!is_visible_file(conn, fname_dir, dname,
2870                                              &smb_fname->st, true)) {
2871                                 TALLOC_FREE(frame);
2872                                 TALLOC_FREE(talloced);
2873                                 continue;
2874                         }
2875
2876                         /* Quick check for "." and ".." */
2877                         if (ISDOT(dname) || ISDOTDOT(dname)) {
2878                                 TALLOC_FREE(frame);
2879                                 TALLOC_FREE(talloced);
2880                                 continue;
2881                         }
2882
2883                         if(!mask_match(dname, fname_mask,
2884                                        conn->case_sensitive)) {
2885                                 TALLOC_FREE(frame);
2886                                 TALLOC_FREE(talloced);
2887                                 continue;
2888                         }
2889
2890                         TALLOC_FREE(smb_fname->base_name);
2891                         if (ISDOT(fname_dir)) {
2892                                 /* Ensure we use canonical names on open. */
2893                                 smb_fname->base_name =
2894                                         talloc_asprintf(smb_fname, "%s",
2895                                                 dname);
2896                         } else {
2897                                 smb_fname->base_name =
2898                                         talloc_asprintf(smb_fname, "%s/%s",
2899                                                 fname_dir, dname);
2900                         }
2901
2902                         if (!smb_fname->base_name) {
2903                                 TALLOC_FREE(dir_hnd);
2904                                 status = NT_STATUS_NO_MEMORY;
2905                                 TALLOC_FREE(frame);
2906                                 TALLOC_FREE(talloced);
2907                                 goto out;
2908                         }
2909
2910                         status = check_name(conn, smb_fname->base_name);
2911                         if (!NT_STATUS_IS_OK(status)) {
2912                                 TALLOC_FREE(dir_hnd);
2913                                 TALLOC_FREE(frame);
2914                                 TALLOC_FREE(talloced);
2915                                 goto out;
2916                         }
2917
2918                         status = do_unlink(conn, req, smb_fname, dirtype);
2919                         if (!NT_STATUS_IS_OK(status)) {
2920                                 TALLOC_FREE(frame);
2921                                 TALLOC_FREE(talloced);
2922                                 continue;
2923                         }
2924
2925                         count++;
2926                         DEBUG(3,("unlink_internals: successful unlink [%s]\n",
2927                                  smb_fname->base_name));
2928
2929                         TALLOC_FREE(frame);
2930                         TALLOC_FREE(talloced);
2931                 }
2932                 TALLOC_FREE(dir_hnd);
2933         }
2934
2935         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
2936                 status = map_nt_error_from_unix(errno);
2937         }
2938
2939  out:
2940         TALLOC_FREE(fname_dir);
2941         TALLOC_FREE(fname_mask);
2942         return status;
2943 }
2944
2945 /****************************************************************************
2946  Reply to a unlink
2947 ****************************************************************************/
2948
2949 void reply_unlink(struct smb_request *req)
2950 {
2951         connection_struct *conn = req->conn;
2952         char *name = NULL;
2953         struct smb_filename *smb_fname = NULL;
2954         uint32 dirtype;
2955         NTSTATUS status;
2956         bool path_contains_wcard = False;
2957         TALLOC_CTX *ctx = talloc_tos();
2958
2959         START_PROFILE(SMBunlink);
2960
2961         if (req->wct < 1) {
2962                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
2963                 goto out;
2964         }
2965
2966         dirtype = SVAL(req->vwv+0, 0);
2967
2968         srvstr_get_path_req_wcard(ctx, req, &name, (const char *)req->buf + 1,
2969                                   STR_TERMINATE, &status,
2970                                   &path_contains_wcard);
2971         if (!NT_STATUS_IS_OK(status)) {
2972                 reply_nterror(req, status);
2973                 goto out;
2974         }
2975
2976         status = filename_convert(ctx, conn,
2977                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
2978                                   name,
2979                                   UCF_COND_ALLOW_WCARD_LCOMP,
2980                                   &path_contains_wcard,
2981                                   &smb_fname);
2982         if (!NT_STATUS_IS_OK(status)) {
2983                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
2984                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
2985                                         ERRSRV, ERRbadpath);
2986                         goto out;
2987                 }
2988                 reply_nterror(req, status);
2989                 goto out;
2990         }
2991
2992         DEBUG(3,("reply_unlink : %s\n", smb_fname_str_dbg(smb_fname)));
2993
2994         status = unlink_internals(conn, req, dirtype, smb_fname,
2995                                   path_contains_wcard);
2996         if (!NT_STATUS_IS_OK(status)) {
2997                 if (open_was_deferred(req->sconn, req->mid)) {
2998                         /* We have re-scheduled this call. */
2999                         goto out;
3000                 }
3001                 reply_nterror(req, status);
3002                 goto out;
3003         }
3004
3005         reply_outbuf(req, 0, 0);
3006  out:
3007         TALLOC_FREE(smb_fname);
3008         END_PROFILE(SMBunlink);
3009         return;
3010 }
3011
3012 /****************************************************************************
3013  Fail for readbraw.
3014 ****************************************************************************/
3015
3016 static void fail_readraw(void)
3017 {
3018         const char *errstr = talloc_asprintf(talloc_tos(),
3019                         "FAIL ! reply_readbraw: socket write fail (%s)",
3020                         strerror(errno));
3021         if (!errstr) {
3022                 errstr = "";
3023         }
3024         exit_server_cleanly(errstr);
3025 }
3026
3027 /****************************************************************************
3028  Fake (read/write) sendfile. Returns -1 on read or write fail.
3029 ****************************************************************************/
3030
3031 ssize_t fake_sendfile(files_struct *fsp, off_t startpos, size_t nread)
3032 {
3033         size_t bufsize;
3034         size_t tosend = nread;
3035         char *buf;
3036
3037         if (nread == 0) {
3038                 return 0;
3039         }
3040
3041         bufsize = MIN(nread, 65536);
3042
3043         if (!(buf = SMB_MALLOC_ARRAY(char, bufsize))) {
3044                 return -1;
3045         }
3046
3047         while (tosend > 0) {
3048                 ssize_t ret;
3049                 size_t cur_read;
3050
3051                 if (tosend > bufsize) {
3052                         cur_read = bufsize;
3053                 } else {
3054                         cur_read = tosend;
3055                 }
3056                 ret = read_file(fsp,buf,startpos,cur_read);
3057                 if (ret == -1) {
3058                         SAFE_FREE(buf);
3059                         return -1;
3060                 }
3061
3062                 /* If we had a short read, fill with zeros. */
3063                 if (ret < cur_read) {
3064                         memset(buf + ret, '\0', cur_read - ret);
3065                 }
3066
3067                 if (write_data(fsp->conn->sconn->sock, buf, cur_read)
3068                     != cur_read) {
3069                         char addr[INET6_ADDRSTRLEN];
3070                         /*
3071                          * Try and give an error message saying what
3072                          * client failed.
3073                          */
3074                         DEBUG(0, ("write_data failed for client %s. "
3075                                   "Error %s\n",
3076                                   get_peer_addr(fsp->conn->sconn->sock, addr,
3077                                                 sizeof(addr)),
3078                                   strerror(errno)));
3079                         SAFE_FREE(buf);
3080                         return -1;
3081                 }
3082                 tosend -= cur_read;
3083                 startpos += cur_read;
3084         }
3085
3086         SAFE_FREE(buf);
3087         return (ssize_t)nread;
3088 }
3089
3090 /****************************************************************************
3091  Deal with the case of sendfile reading less bytes from the file than
3092  requested. Fill with zeros (all we can do).
3093 ****************************************************************************/
3094
3095 void sendfile_short_send(files_struct *fsp,
3096                                 ssize_t nread,
3097                                 size_t headersize,
3098                                 size_t smb_maxcnt)
3099 {
3100 #define SHORT_SEND_BUFSIZE 1024
3101         if (nread < headersize) {
3102                 DEBUG(0,("sendfile_short_send: sendfile failed to send "
3103                         "header for file %s (%s). Terminating\n",
3104                         fsp_str_dbg(fsp), strerror(errno)));
3105                 exit_server_cleanly("sendfile_short_send failed");
3106         }
3107
3108         nread -= headersize;
3109
3110         if (nread < smb_maxcnt) {
3111                 char *buf = SMB_CALLOC_ARRAY(char, SHORT_SEND_BUFSIZE);
3112                 if (!buf) {
3113                         exit_server_cleanly("sendfile_short_send: "
3114                                 "malloc failed");
3115                 }
3116
3117                 DEBUG(0,("sendfile_short_send: filling truncated file %s "
3118                         "with zeros !\n", fsp_str_dbg(fsp)));
3119
3120                 while (nread < smb_maxcnt) {
3121                         /*
3122                          * We asked for the real file size and told sendfile
3123                          * to not go beyond the end of the file. But it can
3124                          * happen that in between our fstat call and the
3125                          * sendfile call the file was truncated. This is very
3126                          * bad because we have already announced the larger
3127                          * number of bytes to the client.
3128                          *
3129                          * The best we can do now is to send 0-bytes, just as
3130                          * a read from a hole in a sparse file would do.
3131                          *
3132                          * This should happen rarely enough that I don't care
3133                          * about efficiency here :-)
3134                          */
3135                         size_t to_write;
3136
3137                         to_write = MIN(SHORT_SEND_BUFSIZE, smb_maxcnt - nread);
3138                         if (write_data(fsp->conn->sconn->sock, buf, to_write)
3139                             != to_write) {
3140                                 char addr[INET6_ADDRSTRLEN];
3141                                 /*
3142                                  * Try and give an error message saying what
3143                                  * client failed.
3144                                  */
3145                                 DEBUG(0, ("write_data failed for client %s. "
3146                                           "Error %s\n",
3147                                           get_peer_addr(
3148                                                   fsp->conn->sconn->sock, addr,
3149                                                   sizeof(addr)),
3150                                           strerror(errno)));
3151                                 exit_server_cleanly("sendfile_short_send: "
3152                                                     "write_data failed");
3153                         }
3154                         nread += to_write;
3155                 }
3156                 SAFE_FREE(buf);
3157         }
3158 }
3159
3160 /****************************************************************************
3161  Return a readbraw error (4 bytes of zero).
3162 ****************************************************************************/
3163
3164 static void reply_readbraw_error(struct smbd_server_connection *sconn)
3165 {
3166         char header[4];
3167
3168         SIVAL(header,0,0);
3169
3170         smbd_lock_socket(sconn);
3171         if (write_data(sconn->sock,header,4) != 4) {
3172                 char addr[INET6_ADDRSTRLEN];
3173                 /*
3174                  * Try and give an error message saying what
3175                  * client failed.
3176                  */
3177                 DEBUG(0, ("write_data failed for client %s. "
3178                           "Error %s\n",
3179                           get_peer_addr(sconn->sock, addr, sizeof(addr)),
3180                           strerror(errno)));
3181
3182                 fail_readraw();
3183         }
3184         smbd_unlock_socket(sconn);
3185 }
3186
3187 /****************************************************************************
3188  Use sendfile in readbraw.
3189 ****************************************************************************/
3190
3191 static void send_file_readbraw(connection_struct *conn,
3192                                struct smb_request *req,
3193                                files_struct *fsp,
3194                                off_t startpos,
3195                                size_t nread,
3196                                ssize_t mincount)
3197 {
3198         struct smbd_server_connection *sconn = req->sconn;
3199         char *outbuf = NULL;
3200         ssize_t ret=0;
3201
3202         /*
3203          * We can only use sendfile on a non-chained packet
3204          * but we can use on a non-oplocked file. tridge proved this
3205          * on a train in Germany :-). JRA.
3206          * reply_readbraw has already checked the length.
3207          */
3208
3209         if ( !req_is_in_chain(req) && (nread > 0) && (fsp->base_fsp == NULL) &&
3210             (fsp->wcp == NULL) &&
3211             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3212                 ssize_t sendfile_read = -1;
3213                 char header[4];
3214                 DATA_BLOB header_blob;
3215
3216                 _smb_setlen(header,nread);
3217                 header_blob = data_blob_const(header, 4);
3218
3219                 sendfile_read = SMB_VFS_SENDFILE(sconn->sock, fsp,
3220                                                  &header_blob, startpos,
3221                                                  nread);
3222                 if (sendfile_read == -1) {
3223                         /* Returning ENOSYS means no data at all was sent.
3224                          * Do this as a normal read. */
3225                         if (errno == ENOSYS) {
3226                                 goto normal_readbraw;
3227                         }
3228
3229                         /*
3230                          * Special hack for broken Linux with no working sendfile. If we
3231                          * return EINTR we sent the header but not the rest of the data.
3232                          * Fake this up by doing read/write calls.
3233                          */
3234                         if (errno == EINTR) {
3235                                 /* Ensure we don't do this again. */
3236                                 set_use_sendfile(SNUM(conn), False);
3237                                 DEBUG(0,("send_file_readbraw: sendfile not available. Faking..\n"));
3238
3239                                 if (fake_sendfile(fsp, startpos, nread) == -1) {
3240                                         DEBUG(0,("send_file_readbraw: "
3241                                                  "fake_sendfile failed for "
3242                                                  "file %s (%s).\n",
3243                                                  fsp_str_dbg(fsp),
3244                                                  strerror(errno)));
3245                                         exit_server_cleanly("send_file_readbraw fake_sendfile failed");
3246                                 }
3247                                 return;
3248                         }
3249
3250                         DEBUG(0,("send_file_readbraw: sendfile failed for "
3251                                  "file %s (%s). Terminating\n",
3252                                  fsp_str_dbg(fsp), strerror(errno)));
3253                         exit_server_cleanly("send_file_readbraw sendfile failed");
3254                 } else if (sendfile_read == 0) {
3255                         /*
3256                          * Some sendfile implementations return 0 to indicate
3257                          * that there was a short read, but nothing was
3258                          * actually written to the socket.  In this case,
3259                          * fallback to the normal read path so the header gets
3260                          * the correct byte count.
3261                          */
3262                         DEBUG(3, ("send_file_readbraw: sendfile sent zero "
3263                                   "bytes falling back to the normal read: "
3264                                   "%s\n", fsp_str_dbg(fsp)));
3265                         goto normal_readbraw;
3266                 }
3267
3268                 /* Deal with possible short send. */
3269                 if (sendfile_read != 4+nread) {
3270                         sendfile_short_send(fsp, sendfile_read, 4, nread);
3271                 }
3272                 return;
3273         }
3274
3275 normal_readbraw:
3276
3277         outbuf = talloc_array(NULL, char, nread+4);
3278         if (!outbuf) {
3279                 DEBUG(0,("send_file_readbraw: talloc_array failed for size %u.\n",
3280                         (unsigned)(nread+4)));
3281                 reply_readbraw_error(sconn);
3282                 return;
3283         }
3284
3285         if (nread > 0) {
3286                 ret = read_file(fsp,outbuf+4,startpos,nread);
3287 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3288                 if (ret < mincount)
3289                         ret = 0;
3290 #else
3291                 if (ret < nread)
3292                         ret = 0;
3293 #endif
3294         }
3295
3296         _smb_setlen(outbuf,ret);
3297         if (write_data(sconn->sock, outbuf, 4+ret) != 4+ret) {
3298                 char addr[INET6_ADDRSTRLEN];
3299                 /*
3300                  * Try and give an error message saying what
3301                  * client failed.
3302                  */
3303                 DEBUG(0, ("write_data failed for client %s. "
3304                           "Error %s\n",
3305                           get_peer_addr(fsp->conn->sconn->sock, addr,
3306                                         sizeof(addr)),
3307                           strerror(errno)));
3308
3309                 fail_readraw();
3310         }
3311
3312         TALLOC_FREE(outbuf);
3313 }
3314
3315 /****************************************************************************
3316  Reply to a readbraw (core+ protocol).
3317 ****************************************************************************/
3318
3319 void reply_readbraw(struct smb_request *req)
3320 {
3321         connection_struct *conn = req->conn;
3322         struct smbd_server_connection *sconn = req->sconn;
3323         ssize_t maxcount,mincount;
3324         size_t nread = 0;
3325         off_t startpos;
3326         files_struct *fsp;
3327         struct lock_struct lock;
3328         off_t size = 0;
3329
3330         START_PROFILE(SMBreadbraw);
3331
3332         if (srv_is_signing_active(sconn) || req->encrypted) {
3333                 exit_server_cleanly("reply_readbraw: SMB signing/sealing is active - "
3334                         "raw reads/writes are disallowed.");
3335         }
3336
3337         if (req->wct < 8) {
3338                 reply_readbraw_error(sconn);
3339                 END_PROFILE(SMBreadbraw);
3340                 return;
3341         }
3342
3343         if (sconn->smb1.echo_handler.trusted_fde) {
3344                 DEBUG(2,("SMBreadbraw rejected with NOT_SUPPORTED because of "
3345                          "'async smb echo handler = yes'\n"));
3346                 reply_readbraw_error(sconn);
3347                 END_PROFILE(SMBreadbraw);
3348                 return;
3349         }
3350
3351         /*
3352          * Special check if an oplock break has been issued
3353          * and the readraw request croses on the wire, we must
3354          * return a zero length response here.
3355          */
3356
3357         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3358
3359         /*
3360          * We have to do a check_fsp by hand here, as
3361          * we must always return 4 zero bytes on error,
3362          * not a NTSTATUS.
3363          */
3364
3365         if (!fsp || !conn || conn != fsp->conn ||
3366                         req->vuid != fsp->vuid ||
3367                         fsp->is_directory || fsp->fh->fd == -1) {
3368                 /*
3369                  * fsp could be NULL here so use the value from the packet. JRA.
3370                  */
3371                 DEBUG(3,("reply_readbraw: fnum %d not valid "
3372                         "- cache prime?\n",
3373                         (int)SVAL(req->vwv+0, 0)));
3374                 reply_readbraw_error(sconn);
3375                 END_PROFILE(SMBreadbraw);
3376                 return;
3377         }
3378
3379         /* Do a "by hand" version of CHECK_READ. */
3380         if (!(fsp->can_read ||
3381                         ((req->flags2 & FLAGS2_READ_PERMIT_EXECUTE) &&
3382                                 (fsp->access_mask & FILE_EXECUTE)))) {
3383                 DEBUG(3,("reply_readbraw: fnum %d not readable.\n",
3384                                 (int)SVAL(req->vwv+0, 0)));
3385                 reply_readbraw_error(sconn);
3386                 END_PROFILE(SMBreadbraw);
3387                 return;
3388         }
3389
3390         flush_write_cache(fsp, READRAW_FLUSH);
3391
3392         startpos = IVAL_TO_SMB_OFF_T(req->vwv+1, 0);
3393         if(req->wct == 10) {
3394                 /*
3395                  * This is a large offset (64 bit) read.
3396                  */
3397
3398                 startpos |= (((off_t)IVAL(req->vwv+8, 0)) << 32);
3399
3400                 if(startpos < 0) {
3401                         DEBUG(0,("reply_readbraw: negative 64 bit "
3402                                 "readraw offset (%.0f) !\n",
3403                                 (double)startpos ));
3404                         reply_readbraw_error(sconn);
3405                         END_PROFILE(SMBreadbraw);
3406                         return;
3407                 }
3408         }
3409
3410         maxcount = (SVAL(req->vwv+3, 0) & 0xFFFF);
3411         mincount = (SVAL(req->vwv+4, 0) & 0xFFFF);
3412
3413         /* ensure we don't overrun the packet size */
3414         maxcount = MIN(65535,maxcount);
3415
3416         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3417             (uint64_t)startpos, (uint64_t)maxcount, READ_LOCK,
3418             &lock);
3419
3420         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3421                 reply_readbraw_error(sconn);
3422                 END_PROFILE(SMBreadbraw);
3423                 return;
3424         }
3425
3426         if (fsp_stat(fsp) == 0) {
3427                 size = fsp->fsp_name->st.st_ex_size;
3428         }
3429
3430         if (startpos >= size) {
3431                 nread = 0;
3432         } else {
3433                 nread = MIN(maxcount,(size - startpos));
3434         }
3435
3436 #if 0 /* mincount appears to be ignored in a W2K server. JRA. */
3437         if (nread < mincount)
3438                 nread = 0;
3439 #endif
3440
3441         DEBUG( 3, ( "reply_readbraw: %s start=%.0f max=%lu "
3442                 "min=%lu nread=%lu\n",
3443                 fsp_fnum_dbg(fsp), (double)startpos,
3444                 (unsigned long)maxcount,
3445                 (unsigned long)mincount,
3446                 (unsigned long)nread ) );
3447
3448         send_file_readbraw(conn, req, fsp, startpos, nread, mincount);
3449
3450         DEBUG(5,("reply_readbraw finished\n"));
3451
3452         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3453
3454         END_PROFILE(SMBreadbraw);
3455         return;
3456 }
3457
3458 #undef DBGC_CLASS
3459 #define DBGC_CLASS DBGC_LOCKING
3460
3461 /****************************************************************************
3462  Reply to a lockread (core+ protocol).
3463 ****************************************************************************/
3464
3465 void reply_lockread(struct smb_request *req)
3466 {
3467         connection_struct *conn = req->conn;
3468         ssize_t nread = -1;
3469         char *data;
3470         off_t startpos;
3471         size_t numtoread;
3472         size_t maxtoread;
3473         NTSTATUS status;
3474         files_struct *fsp;
3475         struct byte_range_lock *br_lck = NULL;
3476         char *p = NULL;
3477         struct smbd_server_connection *sconn = req->sconn;
3478
3479         START_PROFILE(SMBlockread);
3480
3481         if (req->wct < 5) {
3482                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3483                 END_PROFILE(SMBlockread);
3484                 return;
3485         }
3486
3487         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3488
3489         if (!check_fsp(conn, req, fsp)) {
3490                 END_PROFILE(SMBlockread);
3491                 return;
3492         }
3493
3494         if (!CHECK_READ(fsp,req)) {
3495                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3496                 END_PROFILE(SMBlockread);
3497                 return;
3498         }
3499
3500         numtoread = SVAL(req->vwv+1, 0);
3501         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3502
3503         /*
3504          * NB. Discovered by Menny Hamburger at Mainsoft. This is a core+
3505          * protocol request that predates the read/write lock concept.
3506          * Thus instead of asking for a read lock here we need to ask
3507          * for a write lock. JRA.
3508          * Note that the requested lock size is unaffected by max_send.
3509          */
3510
3511         br_lck = do_lock(req->sconn->msg_ctx,
3512                         fsp,
3513                         (uint64_t)req->smbpid,
3514                         (uint64_t)numtoread,
3515                         (uint64_t)startpos,
3516                         WRITE_LOCK,
3517                         WINDOWS_LOCK,
3518                         False, /* Non-blocking lock. */
3519                         &status,
3520                         NULL,
3521                         NULL);
3522         TALLOC_FREE(br_lck);
3523
3524         if (NT_STATUS_V(status)) {
3525                 reply_nterror(req, status);
3526                 END_PROFILE(SMBlockread);
3527                 return;
3528         }
3529
3530         /*
3531          * However the requested READ size IS affected by max_send. Insanity.... JRA.
3532          */
3533         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3534
3535         if (numtoread > maxtoread) {
3536                 DEBUG(0,("reply_lockread: requested read size (%u) is greater than maximum allowed (%u/%u). \
3537 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3538                         (unsigned int)numtoread, (unsigned int)maxtoread,
3539                         (unsigned int)sconn->smb1.sessions.max_send));
3540                 numtoread = maxtoread;
3541         }
3542
3543         reply_outbuf(req, 5, numtoread + 3);
3544
3545         data = smb_buf(req->outbuf) + 3;
3546
3547         nread = read_file(fsp,data,startpos,numtoread);
3548
3549         if (nread < 0) {
3550                 reply_nterror(req, map_nt_error_from_unix(errno));
3551                 END_PROFILE(SMBlockread);
3552                 return;
3553         }
3554
3555         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3556
3557         SSVAL(req->outbuf,smb_vwv0,nread);
3558         SSVAL(req->outbuf,smb_vwv5,nread+3);
3559         p = smb_buf(req->outbuf);
3560         SCVAL(p,0,0); /* pad byte. */
3561         SSVAL(p,1,nread);
3562
3563         DEBUG(3,("lockread %s num=%d nread=%d\n",
3564                  fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3565
3566         END_PROFILE(SMBlockread);
3567         return;
3568 }
3569
3570 #undef DBGC_CLASS
3571 #define DBGC_CLASS DBGC_ALL
3572
3573 /****************************************************************************
3574  Reply to a read.
3575 ****************************************************************************/
3576
3577 void reply_read(struct smb_request *req)
3578 {
3579         connection_struct *conn = req->conn;
3580         size_t numtoread;
3581         size_t maxtoread;
3582         ssize_t nread = 0;
3583         char *data;
3584         off_t startpos;
3585         files_struct *fsp;
3586         struct lock_struct lock;
3587         struct smbd_server_connection *sconn = req->sconn;
3588
3589         START_PROFILE(SMBread);
3590
3591         if (req->wct < 3) {
3592                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3593                 END_PROFILE(SMBread);
3594                 return;
3595         }
3596
3597         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
3598
3599         if (!check_fsp(conn, req, fsp)) {
3600                 END_PROFILE(SMBread);
3601                 return;
3602         }
3603
3604         if (!CHECK_READ(fsp,req)) {
3605                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
3606                 END_PROFILE(SMBread);
3607                 return;
3608         }
3609
3610         numtoread = SVAL(req->vwv+1, 0);
3611         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
3612
3613         /*
3614          * The requested read size cannot be greater than max_send. JRA.
3615          */
3616         maxtoread = sconn->smb1.sessions.max_send - (smb_size + 5*2 + 3);
3617
3618         if (numtoread > maxtoread) {
3619                 DEBUG(0,("reply_read: requested read size (%u) is greater than maximum allowed (%u/%u). \
3620 Returning short read of maximum allowed for compatibility with Windows 2000.\n",
3621                         (unsigned int)numtoread, (unsigned int)maxtoread,
3622                         (unsigned int)sconn->smb1.sessions.max_send));
3623                 numtoread = maxtoread;
3624         }
3625
3626         reply_outbuf(req, 5, numtoread+3);
3627
3628         data = smb_buf(req->outbuf) + 3;
3629
3630         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3631             (uint64_t)startpos, (uint64_t)numtoread, READ_LOCK,
3632             &lock);
3633
3634         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3635                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3636                 END_PROFILE(SMBread);
3637                 return;
3638         }
3639
3640         if (numtoread > 0)
3641                 nread = read_file(fsp,data,startpos,numtoread);
3642
3643         if (nread < 0) {
3644                 reply_nterror(req, map_nt_error_from_unix(errno));
3645                 goto strict_unlock;
3646         }
3647
3648         srv_set_message((char *)req->outbuf, 5, nread+3, False);
3649
3650         SSVAL(req->outbuf,smb_vwv0,nread);
3651         SSVAL(req->outbuf,smb_vwv5,nread+3);
3652         SCVAL(smb_buf(req->outbuf),0,1);
3653         SSVAL(smb_buf(req->outbuf),1,nread);
3654
3655         DEBUG(3, ("read %s num=%d nread=%d\n",
3656                   fsp_fnum_dbg(fsp), (int)numtoread, (int)nread));
3657
3658 strict_unlock:
3659         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3660
3661         END_PROFILE(SMBread);
3662         return;
3663 }
3664
3665 /****************************************************************************
3666  Setup readX header.
3667 ****************************************************************************/
3668
3669 static int setup_readX_header(struct smb_request *req, char *outbuf,
3670                               size_t smb_maxcnt)
3671 {
3672         int outsize;
3673
3674         outsize = srv_set_message(outbuf,12,smb_maxcnt,False);
3675
3676         memset(outbuf+smb_vwv0,'\0',24); /* valgrind init. */
3677
3678         SCVAL(outbuf,smb_vwv0,0xFF);
3679         SSVAL(outbuf,smb_vwv2,0xFFFF); /* Remaining - must be -1. */
3680         SSVAL(outbuf,smb_vwv5,smb_maxcnt);
3681         SSVAL(outbuf,smb_vwv6,
3682               (smb_wct - 4)     /* offset from smb header to wct */
3683               + 1               /* the wct field */
3684               + 12 * sizeof(uint16_t) /* vwv */
3685               + 2);             /* the buflen field */
3686         SSVAL(outbuf,smb_vwv7,(smb_maxcnt >> 16));
3687         SSVAL(outbuf,smb_vwv11,smb_maxcnt);
3688         /* Reset the outgoing length, set_message truncates at 0x1FFFF. */
3689         _smb_setlen_large(outbuf,(smb_size + 12*2 + smb_maxcnt - 4));
3690         return outsize;
3691 }
3692
3693 /****************************************************************************
3694  Reply to a read and X - possibly using sendfile.
3695 ****************************************************************************/
3696
3697 static void send_file_readX(connection_struct *conn, struct smb_request *req,
3698                             files_struct *fsp, off_t startpos,
3699                             size_t smb_maxcnt)
3700 {
3701         ssize_t nread = -1;
3702         struct lock_struct lock;
3703         int saved_errno = 0;
3704
3705         init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
3706             (uint64_t)startpos, (uint64_t)smb_maxcnt, READ_LOCK,
3707             &lock);
3708
3709         if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
3710                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
3711                 return;
3712         }
3713
3714         /*
3715          * We can only use sendfile on a non-chained packet
3716          * but we can use on a non-oplocked file. tridge proved this
3717          * on a train in Germany :-). JRA.
3718          */
3719
3720         if (!req_is_in_chain(req) &&
3721             !req->encrypted &&
3722             (fsp->base_fsp == NULL) &&
3723             (fsp->wcp == NULL) &&
3724             lp_use_sendfile(SNUM(conn), req->sconn->smb1.signing_state) ) {
3725                 uint8 headerbuf[smb_size + 12 * 2];
3726                 DATA_BLOB header;
3727
3728                 if(fsp_stat(fsp) == -1) {
3729                         reply_nterror(req, map_nt_error_from_unix(errno));
3730                         goto strict_unlock;
3731                 }
3732
3733                 if (!S_ISREG(fsp->fsp_name->st.st_ex_mode) ||
3734                     (startpos > fsp->fsp_name->st.st_ex_size) ||
3735                     (smb_maxcnt > (fsp->fsp_name->st.st_ex_size - startpos))) {
3736                         /*
3737                          * We already know that we would do a short read, so don't
3738                          * try the sendfile() path.
3739                          */
3740                         goto nosendfile_read;
3741                 }
3742
3743                 /*
3744                  * Set up the packet header before send. We
3745                  * assume here the sendfile will work (get the
3746                  * correct amount of data).
3747                  */
3748
3749                 header = data_blob_const(headerbuf, sizeof(headerbuf));
3750
3751                 construct_reply_common_req(req, (char *)headerbuf);
3752                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3753
3754                 nread = SMB_VFS_SENDFILE(req->sconn->sock, fsp, &header,
3755                                          startpos, smb_maxcnt);
3756                 if (nread == -1) {
3757                         /* Returning ENOSYS means no data at all was sent.
3758                            Do this as a normal read. */
3759                         if (errno == ENOSYS) {
3760                                 goto normal_read;
3761                         }
3762
3763                         /*
3764                          * Special hack for broken Linux with no working sendfile. If we
3765                          * return EINTR we sent the header but not the rest of the data.
3766                          * Fake this up by doing read/write calls.
3767                          */
3768
3769                         if (errno == EINTR) {
3770                                 /* Ensure we don't do this again. */
3771                                 set_use_sendfile(SNUM(conn), False);
3772                                 DEBUG(0,("send_file_readX: sendfile not available. Faking..\n"));
3773                                 nread = fake_sendfile(fsp, startpos,
3774                                                       smb_maxcnt);
3775                                 if (nread == -1) {
3776                                         DEBUG(0,("send_file_readX: "
3777                                                  "fake_sendfile failed for "
3778                                                  "file %s (%s).\n",
3779                                                  fsp_str_dbg(fsp),
3780                                                  strerror(errno)));
3781                                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3782                                 }
3783                                 DEBUG(3, ("send_file_readX: fake_sendfile %s max=%d nread=%d\n",
3784                                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3785                                 /* No outbuf here means successful sendfile. */
3786                                 goto strict_unlock;
3787                         }
3788
3789                         DEBUG(0,("send_file_readX: sendfile failed for file "
3790                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3791                                  strerror(errno)));
3792                         exit_server_cleanly("send_file_readX sendfile failed");
3793                 } else if (nread == 0) {
3794                         /*
3795                          * Some sendfile implementations return 0 to indicate
3796                          * that there was a short read, but nothing was
3797                          * actually written to the socket.  In this case,
3798                          * fallback to the normal read path so the header gets
3799                          * the correct byte count.
3800                          */
3801                         DEBUG(3, ("send_file_readX: sendfile sent zero bytes "
3802                                   "falling back to the normal read: %s\n",
3803                                   fsp_str_dbg(fsp)));
3804                         goto normal_read;
3805                 }
3806
3807                 DEBUG(3, ("send_file_readX: sendfile %s max=%d nread=%d\n",
3808                           fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3809
3810                 /* Deal with possible short send. */
3811                 if (nread != smb_maxcnt + sizeof(headerbuf)) {
3812                         sendfile_short_send(fsp, nread, sizeof(headerbuf), smb_maxcnt);
3813                 }
3814                 /* No outbuf here means successful sendfile. */
3815                 SMB_PERFCOUNT_SET_MSGLEN_OUT(&req->pcd, nread);
3816                 SMB_PERFCOUNT_END(&req->pcd);
3817                 goto strict_unlock;
3818         }
3819
3820 normal_read:
3821
3822         if ((smb_maxcnt & 0xFF0000) > 0x10000) {
3823                 uint8 headerbuf[smb_size + 2*12];
3824
3825                 construct_reply_common_req(req, (char *)headerbuf);
3826                 setup_readX_header(req, (char *)headerbuf, smb_maxcnt);
3827
3828                 /* Send out the header. */
3829                 if (write_data(req->sconn->sock, (char *)headerbuf,
3830                                sizeof(headerbuf)) != sizeof(headerbuf)) {
3831
3832                         char addr[INET6_ADDRSTRLEN];
3833                         /*
3834                          * Try and give an error message saying what
3835                          * client failed.
3836                          */
3837                         DEBUG(0, ("write_data failed for client %s. "
3838                                   "Error %s\n",
3839                                   get_peer_addr(req->sconn->sock, addr,
3840                                                 sizeof(addr)),
3841                                   strerror(errno)));
3842
3843                         DEBUG(0,("send_file_readX: write_data failed for file "
3844                                  "%s (%s). Terminating\n", fsp_str_dbg(fsp),
3845                                  strerror(errno)));
3846                         exit_server_cleanly("send_file_readX sendfile failed");
3847                 }
3848                 nread = fake_sendfile(fsp, startpos, smb_maxcnt);
3849                 if (nread == -1) {
3850                         DEBUG(0,("send_file_readX: fake_sendfile failed for "
3851                                  "file %s (%s).\n", fsp_str_dbg(fsp),
3852                                  strerror(errno)));
3853                         exit_server_cleanly("send_file_readX: fake_sendfile failed");
3854                 }
3855                 goto strict_unlock;
3856         }
3857
3858 nosendfile_read:
3859
3860         reply_outbuf(req, 12, smb_maxcnt);
3861         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
3862         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
3863
3864         nread = read_file(fsp, smb_buf(req->outbuf), startpos, smb_maxcnt);
3865         saved_errno = errno;
3866
3867         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3868
3869         if (nread < 0) {
3870                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
3871                 return;
3872         }
3873
3874         setup_readX_header(req, (char *)req->outbuf, nread);
3875
3876         DEBUG(3, ("send_file_readX %s max=%d nread=%d\n",
3877                   fsp_fnum_dbg(fsp), (int)smb_maxcnt, (int)nread));
3878         return;
3879
3880  strict_unlock:
3881         SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
3882         TALLOC_FREE(req->outbuf);
3883         return;
3884 }
3885
3886 /****************************************************************************
3887  Work out how much space we have for a read return.
3888 ****************************************************************************/
3889
3890 static size_t calc_max_read_pdu(const struct smb_request *req)
3891 {
3892         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3893                 return req->sconn->smb1.sessions.max_send;
3894         }
3895
3896         if (!lp_large_readwrite()) {
3897                 return req->sconn->smb1.sessions.max_send;
3898         }
3899
3900         if (req_is_in_chain(req)) {
3901                 return req->sconn->smb1.sessions.max_send;
3902         }
3903
3904         if (req->encrypted) {
3905                 /*
3906                  * Don't take encrypted traffic up to the
3907                  * limit. There are padding considerations
3908                  * that make that tricky.
3909                  */
3910                 return req->sconn->smb1.sessions.max_send;
3911         }
3912
3913         if (srv_is_signing_active(req->sconn)) {
3914                 return 0x1FFFF;
3915         }
3916
3917         if (!lp_unix_extensions()) {
3918                 return 0x1FFFF;
3919         }
3920
3921         /*
3922          * We can do ultra-large POSIX reads.
3923          */
3924         return 0xFFFFFF;
3925 }
3926
3927 /****************************************************************************
3928  Calculate how big a read can be. Copes with all clients. It's always
3929  safe to return a short read - Windows does this.
3930 ****************************************************************************/
3931
3932 static size_t calc_read_size(const struct smb_request *req,
3933                              size_t upper_size,
3934                              size_t lower_size)
3935 {
3936         size_t max_pdu = calc_max_read_pdu(req);
3937         size_t total_size = 0;
3938         size_t hdr_len = MIN_SMB_SIZE + VWV(12);
3939         size_t max_len = max_pdu - hdr_len;
3940
3941         /*
3942          * Windows explicitly ignores upper size of 0xFFFF.
3943          * See [MS-SMB].pdf <26> Section 2.2.4.2.1:
3944          * We must do the same as these will never fit even in
3945          * an extended size NetBIOS packet.
3946          */
3947         if (upper_size == 0xFFFF) {
3948                 upper_size = 0;
3949         }
3950
3951         if (req->sconn->conn->protocol < PROTOCOL_NT1) {
3952                 upper_size = 0;
3953         }
3954
3955         total_size = ((upper_size<<16) | lower_size);
3956
3957         /*
3958          * LARGE_READX test shows it's always safe to return
3959          * a short read. Windows does so.
3960          */
3961         return MIN(total_size, max_len);
3962 }
3963
3964 /****************************************************************************
3965  Reply to a read and X.
3966 ****************************************************************************/
3967
3968 void reply_read_and_X(struct smb_request *req)
3969 {
3970         connection_struct *conn = req->conn;
3971         files_struct *fsp;
3972         off_t startpos;
3973         size_t smb_maxcnt;
3974         size_t upper_size;
3975         bool big_readX = False;
3976 #if 0
3977         size_t smb_mincnt = SVAL(req->vwv+6, 0);
3978 #endif
3979
3980         START_PROFILE(SMBreadX);
3981
3982         if ((req->wct != 10) && (req->wct != 12)) {
3983                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
3984                 return;
3985         }
3986
3987         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
3988         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
3989         smb_maxcnt = SVAL(req->vwv+5, 0);
3990
3991         /* If it's an IPC, pass off the pipe handler. */
3992         if (IS_IPC(conn)) {
3993                 reply_pipe_read_and_X(req);
3994                 END_PROFILE(SMBreadX);
3995                 return;
3996         }
3997
3998         if (!check_fsp(conn, req, fsp)) {
3999                 END_PROFILE(SMBreadX);
4000                 return;
4001         }
4002
4003         if (!CHECK_READ(fsp,req)) {
4004                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4005                 END_PROFILE(SMBreadX);
4006                 return;
4007         }
4008
4009         upper_size = SVAL(req->vwv+7, 0);
4010         smb_maxcnt = calc_read_size(req, upper_size, smb_maxcnt);
4011         if (smb_maxcnt > (0x1FFFF - (MIN_SMB_SIZE + VWV(12)))) {
4012                 /*
4013                  * This is a heuristic to avoid keeping large
4014                  * outgoing buffers around over long-lived aio
4015                  * requests.
4016                  */
4017                 big_readX = True;
4018         }
4019
4020         if (req->wct == 12) {
4021                 /*
4022                  * This is a large offset (64 bit) read.
4023                  */
4024                 startpos |= (((off_t)IVAL(req->vwv+10, 0)) << 32);
4025
4026         }
4027
4028         if (!big_readX) {
4029                 NTSTATUS status = schedule_aio_read_and_X(conn,
4030                                         req,
4031                                         fsp,
4032                                         startpos,
4033                                         smb_maxcnt);
4034                 if (NT_STATUS_IS_OK(status)) {
4035                         /* Read scheduled - we're done. */
4036                         goto out;
4037                 }
4038                 if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4039                         /* Real error - report to client. */
4040                         END_PROFILE(SMBreadX);
4041                         reply_nterror(req, status);
4042                         return;
4043                 }
4044                 /* NT_STATUS_RETRY - fall back to sync read. */
4045         }
4046
4047         smbd_lock_socket(req->sconn);
4048         send_file_readX(conn, req, fsp, startpos, smb_maxcnt);
4049         smbd_unlock_socket(req->sconn);
4050
4051  out:
4052         END_PROFILE(SMBreadX);
4053         return;
4054 }
4055
4056 /****************************************************************************
4057  Error replies to writebraw must have smb_wct == 1. Fix this up.
4058 ****************************************************************************/
4059
4060 void error_to_writebrawerr(struct smb_request *req)
4061 {
4062         uint8 *old_outbuf = req->outbuf;
4063
4064         reply_outbuf(req, 1, 0);
4065
4066         memcpy(req->outbuf, old_outbuf, smb_size);
4067         TALLOC_FREE(old_outbuf);
4068 }
4069
4070 /****************************************************************************
4071  Read 4 bytes of a smb packet and return the smb length of the packet.
4072  Store the result in the buffer. This version of the function will
4073  never return a session keepalive (length of zero).
4074  Timeout is in milliseconds.
4075 ****************************************************************************/
4076
4077 static NTSTATUS read_smb_length(int fd, char *inbuf, unsigned int timeout,
4078                                 size_t *len)
4079 {
4080         uint8_t msgtype = NBSSkeepalive;
4081
4082         while (msgtype == NBSSkeepalive) {
4083                 NTSTATUS status;
4084
4085                 status = read_smb_length_return_keepalive(fd, inbuf, timeout,
4086                                                           len);
4087                 if (!NT_STATUS_IS_OK(status)) {
4088                         char addr[INET6_ADDRSTRLEN];
4089                         /* Try and give an error message
4090                          * saying what client failed. */
4091                         DEBUG(0, ("read_fd_with_timeout failed for "
4092                                   "client %s read error = %s.\n",
4093                                   get_peer_addr(fd,addr,sizeof(addr)),
4094                                   nt_errstr(status)));
4095                         return status;
4096                 }
4097
4098                 msgtype = CVAL(inbuf, 0);
4099         }
4100
4101         DEBUG(10,("read_smb_length: got smb length of %lu\n",
4102                   (unsigned long)len));
4103
4104         return NT_STATUS_OK;
4105 }
4106
4107 /****************************************************************************
4108  Reply to a writebraw (core+ or LANMAN1.0 protocol).
4109 ****************************************************************************/
4110
4111 void reply_writebraw(struct smb_request *req)
4112 {
4113         connection_struct *conn = req->conn;
4114         char *buf = NULL;
4115         ssize_t nwritten=0;
4116         ssize_t total_written=0;
4117         size_t numtowrite=0;
4118         size_t tcount;
4119         off_t startpos;
4120         const char *data=NULL;
4121         bool write_through;
4122         files_struct *fsp;
4123         struct lock_struct lock;
4124         NTSTATUS status;
4125
4126         START_PROFILE(SMBwritebraw);
4127
4128         /*
4129          * If we ever reply with an error, it must have the SMB command
4130          * type of SMBwritec, not SMBwriteBraw, as this tells the client
4131          * we're finished.
4132          */
4133         SCVAL(discard_const_p(uint8_t, req->inbuf),smb_com,SMBwritec);
4134
4135         if (srv_is_signing_active(req->sconn)) {
4136                 END_PROFILE(SMBwritebraw);
4137                 exit_server_cleanly("reply_writebraw: SMB signing is active - "
4138                                 "raw reads/writes are disallowed.");
4139         }
4140
4141         if (req->wct < 12) {
4142                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4143                 error_to_writebrawerr(req);
4144                 END_PROFILE(SMBwritebraw);
4145                 return;
4146         }
4147
4148         if (req->sconn->smb1.echo_handler.trusted_fde) {
4149                 DEBUG(2,("SMBwritebraw rejected with NOT_SUPPORTED because of "
4150                          "'async smb echo handler = yes'\n"));
4151                 reply_nterror(req, NT_STATUS_NOT_SUPPORTED);
4152                 error_to_writebrawerr(req);
4153                 END_PROFILE(SMBwritebraw);
4154                 return;
4155         }
4156
4157         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4158         if (!check_fsp(conn, req, fsp)) {
4159                 error_to_writebrawerr(req);
4160                 END_PROFILE(SMBwritebraw);
4161                 return;
4162         }
4163
4164         if (!CHECK_WRITE(fsp)) {
4165                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4166                 error_to_writebrawerr(req);
4167                 END_PROFILE(SMBwritebraw);
4168                 return;
4169         }
4170
4171         tcount = IVAL(req->vwv+1, 0);
4172         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4173         write_through = BITSETW(req->vwv+7,0);
4174
4175         /* We have to deal with slightly different formats depending
4176                 on whether we are using the core+ or lanman1.0 protocol */
4177
4178         if(get_Protocol() <= PROTOCOL_COREPLUS) {
4179                 numtowrite = SVAL(smb_buf_const(req->inbuf),-2);
4180                 data = smb_buf_const(req->inbuf);
4181         } else {
4182                 numtowrite = SVAL(req->vwv+10, 0);
4183                 data = smb_base(req->inbuf) + SVAL(req->vwv+11, 0);
4184         }
4185
4186         /* Ensure we don't write bytes past the end of this packet. */
4187         if (data + numtowrite > smb_base(req->inbuf) + smb_len(req->inbuf)) {
4188                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4189                 error_to_writebrawerr(req);
4190                 END_PROFILE(SMBwritebraw);
4191                 return;
4192         }
4193
4194         if (!fsp->print_file) {
4195                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4196                     (uint64_t)startpos, (uint64_t)tcount, WRITE_LOCK,
4197                     &lock);
4198
4199                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4200                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4201                         error_to_writebrawerr(req);
4202                         END_PROFILE(SMBwritebraw);
4203                         return;
4204                 }
4205         }
4206
4207         if (numtowrite>0) {
4208                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4209         }
4210
4211         DEBUG(3, ("reply_writebraw: initial write %s start=%.0f num=%d "
4212                         "wrote=%d sync=%d\n",
4213                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4214                 (int)nwritten, (int)write_through));
4215
4216         if (nwritten < (ssize_t)numtowrite)  {
4217                 reply_nterror(req, NT_STATUS_DISK_FULL);
4218                 error_to_writebrawerr(req);
4219                 goto strict_unlock;
4220         }
4221
4222         total_written = nwritten;
4223
4224         /* Allocate a buffer of 64k + length. */
4225         buf = talloc_array(NULL, char, 65540);
4226         if (!buf) {
4227                 reply_nterror(req, NT_STATUS_NO_MEMORY);
4228                 error_to_writebrawerr(req);
4229                 goto strict_unlock;
4230         }
4231
4232         /* Return a SMBwritebraw message to the redirector to tell
4233          * it to send more bytes */
4234
4235         memcpy(buf, req->inbuf, smb_size);
4236         srv_set_message(buf,get_Protocol()>PROTOCOL_COREPLUS?1:0,0,True);
4237         SCVAL(buf,smb_com,SMBwritebraw);
4238         SSVALS(buf,smb_vwv0,0xFFFF);
4239         show_msg(buf);
4240         if (!srv_send_smb(req->sconn,
4241                           buf,
4242                           false, 0, /* no signing */
4243                           IS_CONN_ENCRYPTED(conn),
4244                           &req->pcd)) {
4245                 exit_server_cleanly("reply_writebraw: srv_send_smb "
4246                         "failed.");
4247         }
4248
4249         /* Now read the raw data into the buffer and write it */
4250         status = read_smb_length(req->sconn->sock, buf, SMB_SECONDARY_WAIT,
4251                                  &numtowrite);
4252         if (!NT_STATUS_IS_OK(status)) {
4253                 exit_server_cleanly("secondary writebraw failed");
4254         }
4255
4256         /* Set up outbuf to return the correct size */
4257         reply_outbuf(req, 1, 0);
4258
4259         if (numtowrite != 0) {
4260
4261                 if (numtowrite > 0xFFFF) {
4262                         DEBUG(0,("reply_writebraw: Oversize secondary write "
4263                                 "raw requested (%u). Terminating\n",
4264                                 (unsigned int)numtowrite ));
4265                         exit_server_cleanly("secondary writebraw failed");
4266                 }
4267
4268                 if (tcount > nwritten+numtowrite) {
4269                         DEBUG(3,("reply_writebraw: Client overestimated the "
4270                                 "write %d %d %d\n",
4271                                 (int)tcount,(int)nwritten,(int)numtowrite));
4272                 }
4273
4274                 status = read_data(req->sconn->sock, buf+4, numtowrite);
4275
4276                 if (!NT_STATUS_IS_OK(status)) {
4277                         char addr[INET6_ADDRSTRLEN];
4278                         /* Try and give an error message
4279                          * saying what client failed. */
4280                         DEBUG(0, ("reply_writebraw: Oversize secondary write "
4281                                   "raw read failed (%s) for client %s. "
4282                                   "Terminating\n", nt_errstr(status),
4283                                   get_peer_addr(req->sconn->sock, addr,
4284                                                 sizeof(addr))));
4285                         exit_server_cleanly("secondary writebraw failed");
4286                 }
4287
4288                 nwritten = write_file(req,fsp,buf+4,startpos+nwritten,numtowrite);
4289                 if (nwritten == -1) {
4290                         TALLOC_FREE(buf);
4291                         reply_nterror(req, map_nt_error_from_unix(errno));
4292                         error_to_writebrawerr(req);
4293                         goto strict_unlock;
4294                 }
4295
4296                 if (nwritten < (ssize_t)numtowrite) {
4297                         SCVAL(req->outbuf,smb_rcls,ERRHRD);
4298                         SSVAL(req->outbuf,smb_err,ERRdiskfull);
4299                 }
4300
4301                 if (nwritten > 0) {
4302                         total_written += nwritten;
4303                 }
4304         }
4305
4306         TALLOC_FREE(buf);
4307         SSVAL(req->outbuf,smb_vwv0,total_written);
4308
4309         status = sync_file(conn, fsp, write_through);
4310         if (!NT_STATUS_IS_OK(status)) {
4311                 DEBUG(5,("reply_writebraw: sync_file for %s returned %s\n",
4312                          fsp_str_dbg(fsp), nt_errstr(status)));
4313                 reply_nterror(req, status);
4314                 error_to_writebrawerr(req);
4315                 goto strict_unlock;
4316         }
4317
4318         DEBUG(3,("reply_writebraw: secondart write %s start=%.0f num=%d "
4319                 "wrote=%d\n",
4320                 fsp_fnum_dbg(fsp), (double)startpos, (int)numtowrite,
4321                 (int)total_written));
4322
4323         if (!fsp->print_file) {
4324                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4325         }
4326
4327         /* We won't return a status if write through is not selected - this
4328          * follows what WfWg does */
4329         END_PROFILE(SMBwritebraw);
4330
4331         if (!write_through && total_written==tcount) {
4332
4333 #if RABBIT_PELLET_FIX
4334                 /*
4335                  * Fix for "rabbit pellet" mode, trigger an early TCP ack by
4336                  * sending a NBSSkeepalive. Thanks to DaveCB at Sun for this.
4337                  * JRA.
4338                  */
4339                 if (!send_keepalive(req->sconn->sock)) {
4340                         exit_server_cleanly("reply_writebraw: send of "
4341                                 "keepalive failed");
4342                 }
4343 #endif
4344                 TALLOC_FREE(req->outbuf);
4345         }
4346         return;
4347
4348 strict_unlock:
4349         if (!fsp->print_file) {
4350                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4351         }
4352
4353         END_PROFILE(SMBwritebraw);
4354         return;
4355 }
4356
4357 #undef DBGC_CLASS
4358 #define DBGC_CLASS DBGC_LOCKING
4359
4360 /****************************************************************************
4361  Reply to a writeunlock (core+).
4362 ****************************************************************************/
4363
4364 void reply_writeunlock(struct smb_request *req)
4365 {
4366         connection_struct *conn = req->conn;
4367         ssize_t nwritten = -1;
4368         size_t numtowrite;
4369         off_t startpos;
4370         const char *data;
4371         NTSTATUS status = NT_STATUS_OK;
4372         files_struct *fsp;
4373         struct lock_struct lock;
4374         int saved_errno = 0;
4375
4376         START_PROFILE(SMBwriteunlock);
4377
4378         if (req->wct < 5) {
4379                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4380                 END_PROFILE(SMBwriteunlock);
4381                 return;
4382         }
4383
4384         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4385
4386         if (!check_fsp(conn, req, fsp)) {
4387                 END_PROFILE(SMBwriteunlock);
4388                 return;
4389         }
4390
4391         if (!CHECK_WRITE(fsp)) {
4392                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4393                 END_PROFILE(SMBwriteunlock);
4394                 return;
4395         }
4396
4397         numtowrite = SVAL(req->vwv+1, 0);
4398         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4399         data = (const char *)req->buf + 3;
4400
4401         if (!fsp->print_file && numtowrite > 0) {
4402                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4403                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4404                     &lock);
4405
4406                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4407                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4408                         END_PROFILE(SMBwriteunlock);
4409                         return;
4410                 }
4411         }
4412
4413         /* The special X/Open SMB protocol handling of
4414            zero length writes is *NOT* done for
4415            this call */
4416         if(numtowrite == 0) {
4417                 nwritten = 0;
4418         } else {
4419                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4420                 saved_errno = errno;
4421         }
4422
4423         status = sync_file(conn, fsp, False /* write through */);
4424         if (!NT_STATUS_IS_OK(status)) {
4425                 DEBUG(5,("reply_writeunlock: sync_file for %s returned %s\n",
4426                          fsp_str_dbg(fsp), nt_errstr(status)));
4427                 reply_nterror(req, status);
4428                 goto strict_unlock;
4429         }
4430
4431         if(nwritten < 0) {
4432                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4433                 goto strict_unlock;
4434         }
4435
4436         if((nwritten < numtowrite) && (numtowrite != 0)) {
4437                 reply_nterror(req, NT_STATUS_DISK_FULL);
4438                 goto strict_unlock;
4439         }
4440
4441         if (numtowrite && !fsp->print_file) {
4442                 status = do_unlock(req->sconn->msg_ctx,
4443                                 fsp,
4444                                 (uint64_t)req->smbpid,
4445                                 (uint64_t)numtowrite,
4446                                 (uint64_t)startpos,
4447                                 WINDOWS_LOCK);
4448
4449                 if (NT_STATUS_V(status)) {
4450                         reply_nterror(req, status);
4451                         goto strict_unlock;
4452                 }
4453         }
4454
4455         reply_outbuf(req, 1, 0);
4456
4457         SSVAL(req->outbuf,smb_vwv0,nwritten);
4458
4459         DEBUG(3, ("writeunlock %s num=%d wrote=%d\n",
4460                   fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4461
4462 strict_unlock:
4463         if (numtowrite && !fsp->print_file) {
4464                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4465         }
4466
4467         END_PROFILE(SMBwriteunlock);
4468         return;
4469 }
4470
4471 #undef DBGC_CLASS
4472 #define DBGC_CLASS DBGC_ALL
4473
4474 /****************************************************************************
4475  Reply to a write.
4476 ****************************************************************************/
4477
4478 void reply_write(struct smb_request *req)
4479 {
4480         connection_struct *conn = req->conn;
4481         size_t numtowrite;
4482         ssize_t nwritten = -1;
4483         off_t startpos;
4484         const char *data;
4485         files_struct *fsp;
4486         struct lock_struct lock;
4487         NTSTATUS status;
4488         int saved_errno = 0;
4489
4490         START_PROFILE(SMBwrite);
4491
4492         if (req->wct < 5) {
4493                 END_PROFILE(SMBwrite);
4494                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4495                 return;
4496         }
4497
4498         /* If it's an IPC, pass off the pipe handler. */
4499         if (IS_IPC(conn)) {
4500                 reply_pipe_write(req);
4501                 END_PROFILE(SMBwrite);
4502                 return;
4503         }
4504
4505         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4506
4507         if (!check_fsp(conn, req, fsp)) {
4508                 END_PROFILE(SMBwrite);
4509                 return;
4510         }
4511
4512         if (!CHECK_WRITE(fsp)) {
4513                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4514                 END_PROFILE(SMBwrite);
4515                 return;
4516         }
4517
4518         numtowrite = SVAL(req->vwv+1, 0);
4519         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
4520         data = (const char *)req->buf + 3;
4521
4522         if (!fsp->print_file) {
4523                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4524                         (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4525                         &lock);
4526
4527                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4528                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4529                         END_PROFILE(SMBwrite);
4530                         return;
4531                 }
4532         }
4533
4534         /*
4535          * X/Open SMB protocol says that if smb_vwv1 is
4536          * zero then the file size should be extended or
4537          * truncated to the size given in smb_vwv[2-3].
4538          */
4539
4540         if(numtowrite == 0) {
4541                 /*
4542                  * This is actually an allocate call, and set EOF. JRA.
4543                  */
4544                 nwritten = vfs_allocate_file_space(fsp, (off_t)startpos);
4545                 if (nwritten < 0) {
4546                         reply_nterror(req, NT_STATUS_DISK_FULL);
4547                         goto strict_unlock;
4548                 }
4549                 nwritten = vfs_set_filelen(fsp, (off_t)startpos);
4550                 if (nwritten < 0) {
4551                         reply_nterror(req, NT_STATUS_DISK_FULL);
4552                         goto strict_unlock;
4553                 }
4554                 trigger_write_time_update_immediate(fsp);
4555         } else {
4556                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4557         }
4558
4559         status = sync_file(conn, fsp, False);
4560         if (!NT_STATUS_IS_OK(status)) {
4561                 DEBUG(5,("reply_write: sync_file for %s returned %s\n",
4562                          fsp_str_dbg(fsp), nt_errstr(status)));
4563                 reply_nterror(req, status);
4564                 goto strict_unlock;
4565         }
4566
4567         if(nwritten < 0) {
4568                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4569                 goto strict_unlock;
4570         }
4571
4572         if((nwritten == 0) && (numtowrite != 0)) {
4573                 reply_nterror(req, NT_STATUS_DISK_FULL);
4574                 goto strict_unlock;
4575         }
4576
4577         reply_outbuf(req, 1, 0);
4578
4579         SSVAL(req->outbuf,smb_vwv0,nwritten);
4580
4581         if (nwritten < (ssize_t)numtowrite) {
4582                 SCVAL(req->outbuf,smb_rcls,ERRHRD);
4583                 SSVAL(req->outbuf,smb_err,ERRdiskfull);
4584         }
4585
4586         DEBUG(3, ("write %s num=%d wrote=%d\n", fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4587
4588 strict_unlock:
4589         if (!fsp->print_file) {
4590                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4591         }
4592
4593         END_PROFILE(SMBwrite);
4594         return;
4595 }
4596
4597 /****************************************************************************
4598  Ensure a buffer is a valid writeX for recvfile purposes.
4599 ****************************************************************************/
4600
4601 #define STANDARD_WRITE_AND_X_HEADER_SIZE (smb_size - 4 + /* basic header */ \
4602                                                 (2*14) + /* word count (including bcc) */ \
4603                                                 1 /* pad byte */)
4604
4605 bool is_valid_writeX_buffer(struct smbd_server_connection *sconn,
4606                             const uint8_t *inbuf)
4607 {
4608         size_t numtowrite;
4609         connection_struct *conn = NULL;
4610         unsigned int doff = 0;
4611         size_t len = smb_len_large(inbuf);
4612         struct smbXsrv_tcon *tcon;
4613         NTSTATUS status;
4614         NTTIME now = 0;
4615
4616         if (is_encrypted_packet(sconn, inbuf)) {
4617                 /* Can't do this on encrypted
4618                  * connections. */
4619                 return false;
4620         }
4621
4622         if (CVAL(inbuf,smb_com) != SMBwriteX) {
4623                 return false;
4624         }
4625
4626         if (CVAL(inbuf,smb_vwv0) != 0xFF ||
4627                         CVAL(inbuf,smb_wct) != 14) {
4628                 DEBUG(10,("is_valid_writeX_buffer: chained or "
4629                         "invalid word length.\n"));
4630                 return false;
4631         }
4632
4633         status = smb1srv_tcon_lookup(sconn->conn, SVAL(inbuf, smb_tid),
4634                                      now, &tcon);
4635         if (!NT_STATUS_IS_OK(status)) {
4636                 DEBUG(10,("is_valid_writeX_buffer: bad tid\n"));
4637                 return false;
4638         }
4639         conn = tcon->compat;
4640
4641         if (IS_IPC(conn)) {
4642                 DEBUG(10,("is_valid_writeX_buffer: IPC$ tid\n"));
4643                 return false;
4644         }
4645         if (IS_PRINT(conn)) {
4646                 DEBUG(10,("is_valid_writeX_buffer: printing tid\n"));
4647                 return false;
4648         }
4649         doff = SVAL(inbuf,smb_vwv11);
4650
4651         numtowrite = SVAL(inbuf,smb_vwv10);
4652
4653         if (len > doff && len - doff > 0xFFFF) {
4654                 numtowrite |= (((size_t)SVAL(inbuf,smb_vwv9))<<16);
4655         }
4656
4657         if (numtowrite == 0) {
4658                 DEBUG(10,("is_valid_writeX_buffer: zero write\n"));
4659                 return false;
4660         }
4661
4662         /* Ensure the sizes match up. */
4663         if (doff < STANDARD_WRITE_AND_X_HEADER_SIZE) {
4664                 /* no pad byte...old smbclient :-( */
4665                 DEBUG(10,("is_valid_writeX_buffer: small doff %u (min %u)\n",
4666                         (unsigned int)doff,
4667                         (unsigned int)STANDARD_WRITE_AND_X_HEADER_SIZE));
4668                 return false;
4669         }
4670
4671         if (len - doff != numtowrite) {
4672                 DEBUG(10,("is_valid_writeX_buffer: doff mismatch "
4673                         "len = %u, doff = %u, numtowrite = %u\n",
4674                         (unsigned int)len,
4675                         (unsigned int)doff,
4676                         (unsigned int)numtowrite ));
4677                 return false;
4678         }
4679
4680         DEBUG(10,("is_valid_writeX_buffer: true "
4681                 "len = %u, doff = %u, numtowrite = %u\n",
4682                 (unsigned int)len,
4683                 (unsigned int)doff,
4684                 (unsigned int)numtowrite ));
4685
4686         return true;
4687 }
4688
4689 /****************************************************************************
4690  Reply to a write and X.
4691 ****************************************************************************/
4692
4693 void reply_write_and_X(struct smb_request *req)
4694 {
4695         connection_struct *conn = req->conn;
4696         files_struct *fsp;
4697         struct lock_struct lock;
4698         off_t startpos;
4699         size_t numtowrite;
4700         bool write_through;
4701         ssize_t nwritten;
4702         unsigned int smb_doff;
4703         unsigned int smblen;
4704         const char *data;
4705         NTSTATUS status;
4706         int saved_errno = 0;
4707
4708         START_PROFILE(SMBwriteX);
4709
4710         if ((req->wct != 12) && (req->wct != 14)) {
4711                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4712                 goto out;
4713         }
4714
4715         numtowrite = SVAL(req->vwv+10, 0);
4716         smb_doff = SVAL(req->vwv+11, 0);
4717         smblen = smb_len(req->inbuf);
4718
4719         if (req->unread_bytes > 0xFFFF ||
4720                         (smblen > smb_doff &&
4721                                 smblen - smb_doff > 0xFFFF)) {
4722                 numtowrite |= (((size_t)SVAL(req->vwv+9, 0))<<16);
4723         }
4724
4725         if (req->unread_bytes) {
4726                 /* Can't do a recvfile write on IPC$ */
4727                 if (IS_IPC(conn)) {
4728                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4729                         goto out;
4730                 }
4731                 if (numtowrite != req->unread_bytes) {
4732                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4733                         goto out;
4734                 }
4735         } else {
4736                 if (smb_doff > smblen || smb_doff + numtowrite < numtowrite ||
4737                                 smb_doff + numtowrite > smblen) {
4738                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4739                         goto out;
4740                 }
4741         }
4742
4743         /* If it's an IPC, pass off the pipe handler. */
4744         if (IS_IPC(conn)) {
4745                 if (req->unread_bytes) {
4746                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4747                         goto out;
4748                 }
4749                 reply_pipe_write_and_X(req);
4750                 goto out;
4751         }
4752
4753         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
4754         startpos = IVAL_TO_SMB_OFF_T(req->vwv+3, 0);
4755         write_through = BITSETW(req->vwv+7,0);
4756
4757         if (!check_fsp(conn, req, fsp)) {
4758                 goto out;
4759         }
4760
4761         if (!CHECK_WRITE(fsp)) {
4762                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
4763                 goto out;
4764         }
4765
4766         data = smb_base(req->inbuf) + smb_doff;
4767
4768         if(req->wct == 14) {
4769                 /*
4770                  * This is a large offset (64 bit) write.
4771                  */
4772                 startpos |= (((off_t)IVAL(req->vwv+12, 0)) << 32);
4773
4774         }
4775
4776         /* X/Open SMB protocol says that, unlike SMBwrite
4777         if the length is zero then NO truncation is
4778         done, just a write of zero. To truncate a file,
4779         use SMBwrite. */
4780
4781         if(numtowrite == 0) {
4782                 nwritten = 0;
4783         } else {
4784                 if (req->unread_bytes == 0) {
4785                         status = schedule_aio_write_and_X(conn,
4786                                                 req,
4787                                                 fsp,
4788                                                 data,
4789                                                 startpos,
4790                                                 numtowrite);
4791
4792                         if (NT_STATUS_IS_OK(status)) {
4793                                 /* write scheduled - we're done. */
4794                                 goto out;
4795                         }
4796                         if (!NT_STATUS_EQUAL(status, NT_STATUS_RETRY)) {
4797                                 /* Real error - report to client. */
4798                                 reply_nterror(req, status);
4799                                 goto out;
4800                         }
4801                         /* NT_STATUS_RETRY - fall through to sync write. */
4802                 }
4803
4804                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
4805                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
4806                     &lock);
4807
4808                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
4809                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
4810                         goto out;
4811                 }
4812
4813                 nwritten = write_file(req,fsp,data,startpos,numtowrite);
4814                 saved_errno = errno;
4815
4816                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
4817         }
4818
4819         if(nwritten < 0) {
4820                 reply_nterror(req, map_nt_error_from_unix(saved_errno));
4821                 goto out;
4822         }
4823
4824         if((nwritten == 0) && (numtowrite != 0)) {
4825                 reply_nterror(req, NT_STATUS_DISK_FULL);
4826                 goto out;
4827         }
4828
4829         reply_outbuf(req, 6, 0);
4830         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
4831         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
4832         SSVAL(req->outbuf,smb_vwv2,nwritten);
4833         SSVAL(req->outbuf,smb_vwv4,nwritten>>16);
4834
4835         DEBUG(3,("writeX %s num=%d wrote=%d\n",
4836                 fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten));
4837
4838         status = sync_file(conn, fsp, write_through);
4839         if (!NT_STATUS_IS_OK(status)) {
4840                 DEBUG(5,("reply_write_and_X: sync_file for %s returned %s\n",
4841                          fsp_str_dbg(fsp), nt_errstr(status)));
4842                 reply_nterror(req, status);
4843                 goto out;
4844         }
4845
4846         END_PROFILE(SMBwriteX);
4847         return;
4848
4849 out:
4850         if (req->unread_bytes) {
4851                 /* writeX failed. drain socket. */
4852                 if (drain_socket(req->sconn->sock, req->unread_bytes) !=
4853                                 req->unread_bytes) {
4854                         smb_panic("failed to drain pending bytes");
4855                 }
4856                 req->unread_bytes = 0;
4857         }
4858
4859         END_PROFILE(SMBwriteX);
4860         return;
4861 }
4862
4863 /****************************************************************************
4864  Reply to a lseek.
4865 ****************************************************************************/
4866
4867 void reply_lseek(struct smb_request *req)
4868 {
4869         connection_struct *conn = req->conn;
4870         off_t startpos;
4871         off_t res= -1;
4872         int mode,umode;
4873         files_struct *fsp;
4874
4875         START_PROFILE(SMBlseek);
4876
4877         if (req->wct < 4) {
4878                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4879                 END_PROFILE(SMBlseek);
4880                 return;
4881         }
4882
4883         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
4884
4885         if (!check_fsp(conn, req, fsp)) {
4886                 return;
4887         }
4888
4889         flush_write_cache(fsp, SEEK_FLUSH);
4890
4891         mode = SVAL(req->vwv+1, 0) & 3;
4892         /* NB. This doesn't use IVAL_TO_SMB_OFF_T as startpos can be signed in this case. */
4893         startpos = (off_t)IVALS(req->vwv+2, 0);
4894
4895         switch (mode) {
4896                 case 0:
4897                         umode = SEEK_SET;
4898                         res = startpos;
4899                         break;
4900                 case 1:
4901                         umode = SEEK_CUR;
4902                         res = fsp->fh->pos + startpos;
4903                         break;
4904                 case 2:
4905                         umode = SEEK_END;
4906                         break;
4907                 default:
4908                         umode = SEEK_SET;
4909                         res = startpos;
4910                         break;
4911         }
4912
4913         if (umode == SEEK_END) {
4914                 if((res = SMB_VFS_LSEEK(fsp,startpos,umode)) == -1) {
4915                         if(errno == EINVAL) {
4916                                 off_t current_pos = startpos;
4917
4918                                 if(fsp_stat(fsp) == -1) {
4919                                         reply_nterror(req,
4920                                                 map_nt_error_from_unix(errno));
4921                                         END_PROFILE(SMBlseek);
4922                                         return;
4923                                 }
4924
4925                                 current_pos += fsp->fsp_name->st.st_ex_size;
4926                                 if(current_pos < 0)
4927                                         res = SMB_VFS_LSEEK(fsp,0,SEEK_SET);
4928                         }
4929                 }
4930
4931                 if(res == -1) {
4932                         reply_nterror(req, map_nt_error_from_unix(errno));
4933                         END_PROFILE(SMBlseek);
4934                         return;
4935                 }
4936         }
4937
4938         fsp->fh->pos = res;
4939
4940         reply_outbuf(req, 2, 0);
4941         SIVAL(req->outbuf,smb_vwv0,res);
4942
4943         DEBUG(3,("lseek %s ofs=%.0f newpos = %.0f mode=%d\n",
4944                 fsp_fnum_dbg(fsp), (double)startpos, (double)res, mode));
4945
4946         END_PROFILE(SMBlseek);
4947         return;
4948 }
4949
4950 /****************************************************************************
4951  Reply to a flush.
4952 ****************************************************************************/
4953
4954 void reply_flush(struct smb_request *req)
4955 {
4956         connection_struct *conn = req->conn;
4957         uint16 fnum;
4958         files_struct *fsp;
4959
4960         START_PROFILE(SMBflush);
4961
4962         if (req->wct < 1) {
4963                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
4964                 return;
4965         }
4966
4967         fnum = SVAL(req->vwv+0, 0);
4968         fsp = file_fsp(req, fnum);
4969
4970         if ((fnum != 0xFFFF) && !check_fsp(conn, req, fsp)) {
4971                 return;
4972         }
4973
4974         if (!fsp) {
4975                 file_sync_all(conn);
4976         } else {
4977                 NTSTATUS status = sync_file(conn, fsp, True);
4978                 if (!NT_STATUS_IS_OK(status)) {
4979                         DEBUG(5,("reply_flush: sync_file for %s returned %s\n",
4980                                 fsp_str_dbg(fsp), nt_errstr(status)));
4981                         reply_nterror(req, status);
4982                         END_PROFILE(SMBflush);
4983                         return;
4984                 }
4985         }
4986
4987         reply_outbuf(req, 0, 0);
4988
4989         DEBUG(3,("flush\n"));
4990         END_PROFILE(SMBflush);
4991         return;
4992 }
4993
4994 /****************************************************************************
4995  Reply to a exit.
4996  conn POINTER CAN BE NULL HERE !
4997 ****************************************************************************/
4998
4999 void reply_exit(struct smb_request *req)
5000 {
5001         START_PROFILE(SMBexit);
5002
5003         file_close_pid(req->sconn, req->smbpid, req->vuid);
5004
5005         reply_outbuf(req, 0, 0);
5006
5007         DEBUG(3,("exit\n"));
5008
5009         END_PROFILE(SMBexit);
5010         return;
5011 }
5012
5013 struct reply_close_state {
5014         files_struct *fsp;
5015         struct smb_request *smbreq;
5016 };
5017
5018 static void do_smb1_close(struct tevent_req *req);
5019
5020 void reply_close(struct smb_request *req)
5021 {
5022         connection_struct *conn = req->conn;
5023         NTSTATUS status = NT_STATUS_OK;
5024         files_struct *fsp = NULL;
5025         START_PROFILE(SMBclose);
5026
5027         if (req->wct < 3) {
5028                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5029                 END_PROFILE(SMBclose);
5030                 return;
5031         }
5032
5033         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5034
5035         /*
5036          * We can only use check_fsp if we know it's not a directory.
5037          */
5038
5039         if (!check_fsp_open(conn, req, fsp)) {
5040                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
5041                 END_PROFILE(SMBclose);
5042                 return;
5043         }
5044
5045         DEBUG(3, ("Close %s fd=%d %s (numopen=%d)\n",
5046                   fsp->is_directory ? "directory" : "file",
5047                   fsp->fh->fd, fsp_fnum_dbg(fsp),
5048                   conn->num_files_open));
5049
5050         if (!fsp->is_directory) {
5051                 time_t t;
5052
5053                 /*
5054                  * Take care of any time sent in the close.
5055                  */
5056
5057                 t = srv_make_unix_date3(req->vwv+1);
5058                 set_close_write_time(fsp, convert_time_t_to_timespec(t));
5059         }
5060
5061         if (fsp->num_aio_requests != 0) {
5062
5063                 struct reply_close_state *state;
5064
5065                 DEBUG(10, ("closing with aio %u requests pending\n",
5066                            fsp->num_aio_requests));
5067
5068                 /*
5069                  * We depend on the aio_extra destructor to take care of this
5070                  * close request once fsp->num_aio_request drops to 0.
5071                  */
5072
5073                 fsp->deferred_close = tevent_wait_send(
5074                         fsp, fsp->conn->sconn->ev_ctx);
5075                 if (fsp->deferred_close == NULL) {
5076                         status = NT_STATUS_NO_MEMORY;
5077                         goto done;
5078                 }
5079
5080                 state = talloc(fsp, struct reply_close_state);
5081                 if (state == NULL) {
5082                         TALLOC_FREE(fsp->deferred_close);
5083                         status = NT_STATUS_NO_MEMORY;
5084                         goto done;
5085                 }
5086                 state->fsp = fsp;
5087                 state->smbreq = talloc_move(fsp, &req);
5088                 tevent_req_set_callback(fsp->deferred_close, do_smb1_close,
5089                                         state);
5090                 END_PROFILE(SMBclose);
5091                 return;
5092         }
5093
5094         /*
5095          * close_file() returns the unix errno if an error was detected on
5096          * close - normally this is due to a disk full error. If not then it
5097          * was probably an I/O error.
5098          */
5099
5100         status = close_file(req, fsp, NORMAL_CLOSE);
5101 done:
5102         if (!NT_STATUS_IS_OK(status)) {
5103                 reply_nterror(req, status);
5104                 END_PROFILE(SMBclose);
5105                 return;
5106         }
5107
5108         reply_outbuf(req, 0, 0);
5109         END_PROFILE(SMBclose);
5110         return;
5111 }
5112
5113 static void do_smb1_close(struct tevent_req *req)
5114 {
5115         struct reply_close_state *state = tevent_req_callback_data(
5116                 req, struct reply_close_state);
5117         struct smb_request *smbreq;
5118         NTSTATUS status;
5119         int ret;
5120
5121         ret = tevent_wait_recv(req);
5122         TALLOC_FREE(req);
5123         if (ret != 0) {
5124                 DEBUG(10, ("tevent_wait_recv returned %s\n",
5125                            strerror(ret)));
5126                 /*
5127                  * Continue anyway, this should never happen
5128                  */
5129         }
5130
5131         /*
5132          * fsp->smb2_close_request right now is a talloc grandchild of
5133          * fsp. When we close_file(fsp), it would go with it. No chance to
5134          * reply...
5135          */
5136         smbreq = talloc_move(talloc_tos(), &state->smbreq);
5137
5138         status = close_file(smbreq, state->fsp, NORMAL_CLOSE);
5139         if (NT_STATUS_IS_OK(status)) {
5140                 reply_outbuf(smbreq, 0, 0);
5141         } else {
5142                 reply_nterror(smbreq, status);
5143         }
5144         if (!srv_send_smb(smbreq->sconn,
5145                         (char *)smbreq->outbuf,
5146                         true,
5147                         smbreq->seqnum+1,
5148                         IS_CONN_ENCRYPTED(smbreq->conn)||smbreq->encrypted,
5149                         NULL)) {
5150                 exit_server_cleanly("handle_aio_read_complete: srv_send_smb "
5151                                     "failed.");
5152         }
5153         TALLOC_FREE(smbreq);
5154 }
5155
5156 /****************************************************************************
5157  Reply to a writeclose (Core+ protocol).
5158 ****************************************************************************/
5159
5160 void reply_writeclose(struct smb_request *req)
5161 {
5162         connection_struct *conn = req->conn;
5163         size_t numtowrite;
5164         ssize_t nwritten = -1;
5165         NTSTATUS close_status = NT_STATUS_OK;
5166         off_t startpos;
5167         const char *data;
5168         struct timespec mtime;
5169         files_struct *fsp;
5170         struct lock_struct lock;
5171
5172         START_PROFILE(SMBwriteclose);
5173
5174         if (req->wct < 6) {
5175                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5176                 END_PROFILE(SMBwriteclose);
5177                 return;
5178         }
5179
5180         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5181
5182         if (!check_fsp(conn, req, fsp)) {
5183                 END_PROFILE(SMBwriteclose);
5184                 return;
5185         }
5186         if (!CHECK_WRITE(fsp)) {
5187                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5188                 END_PROFILE(SMBwriteclose);
5189                 return;
5190         }
5191
5192         numtowrite = SVAL(req->vwv+1, 0);
5193         startpos = IVAL_TO_SMB_OFF_T(req->vwv+2, 0);
5194         mtime = convert_time_t_to_timespec(srv_make_unix_date3(req->vwv+4));
5195         data = (const char *)req->buf + 1;
5196
5197         if (!fsp->print_file) {
5198                 init_strict_lock_struct(fsp, (uint64_t)req->smbpid,
5199                     (uint64_t)startpos, (uint64_t)numtowrite, WRITE_LOCK,
5200                     &lock);
5201
5202                 if (!SMB_VFS_STRICT_LOCK(conn, fsp, &lock)) {
5203                         reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
5204                         END_PROFILE(SMBwriteclose);
5205                         return;
5206                 }
5207         }
5208
5209         nwritten = write_file(req,fsp,data,startpos,numtowrite);
5210
5211         set_close_write_time(fsp, mtime);
5212
5213         /*
5214          * More insanity. W2K only closes the file if writelen > 0.
5215          * JRA.
5216          */
5217
5218         if (numtowrite) {
5219                 DEBUG(3,("reply_writeclose: zero length write doesn't close "
5220                          "file %s\n", fsp_str_dbg(fsp)));
5221                 close_status = close_file(req, fsp, NORMAL_CLOSE);
5222         }
5223
5224         DEBUG(3,("writeclose %s num=%d wrote=%d (numopen=%d)\n",
5225                  fsp_fnum_dbg(fsp), (int)numtowrite, (int)nwritten,
5226                  conn->num_files_open));
5227
5228         if(((nwritten == 0) && (numtowrite != 0))||(nwritten < 0)) {
5229                 reply_nterror(req, NT_STATUS_DISK_FULL);
5230                 goto strict_unlock;
5231         }
5232
5233         if(!NT_STATUS_IS_OK(close_status)) {
5234                 reply_nterror(req, close_status);
5235                 goto strict_unlock;
5236         }
5237
5238         reply_outbuf(req, 1, 0);
5239
5240         SSVAL(req->outbuf,smb_vwv0,nwritten);
5241
5242 strict_unlock:
5243         if (numtowrite && !fsp->print_file) {
5244                 SMB_VFS_STRICT_UNLOCK(conn, fsp, &lock);
5245         }
5246
5247         END_PROFILE(SMBwriteclose);
5248         return;
5249 }
5250
5251 #undef DBGC_CLASS
5252 #define DBGC_CLASS DBGC_LOCKING
5253
5254 /****************************************************************************
5255  Reply to a lock.
5256 ****************************************************************************/
5257
5258 void reply_lock(struct smb_request *req)
5259 {
5260         connection_struct *conn = req->conn;
5261         uint64_t count,offset;
5262         NTSTATUS status;
5263         files_struct *fsp;
5264         struct byte_range_lock *br_lck = NULL;
5265
5266         START_PROFILE(SMBlock);
5267
5268         if (req->wct < 5) {
5269                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5270                 END_PROFILE(SMBlock);
5271                 return;
5272         }
5273
5274         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5275
5276         if (!check_fsp(conn, req, fsp)) {
5277                 END_PROFILE(SMBlock);
5278                 return;
5279         }
5280
5281         count = (uint64_t)IVAL(req->vwv+1, 0);
5282         offset = (uint64_t)IVAL(req->vwv+3, 0);
5283
5284         DEBUG(3,("lock fd=%d %s offset=%.0f count=%.0f\n",
5285                  fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count));
5286
5287         br_lck = do_lock(req->sconn->msg_ctx,
5288                         fsp,
5289                         (uint64_t)req->smbpid,
5290                         count,
5291                         offset,
5292                         WRITE_LOCK,
5293                         WINDOWS_LOCK,
5294                         False, /* Non-blocking lock. */
5295                         &status,
5296                         NULL,
5297                         NULL);
5298
5299         TALLOC_FREE(br_lck);
5300
5301         if (NT_STATUS_V(status)) {
5302                 reply_nterror(req, status);
5303                 END_PROFILE(SMBlock);
5304                 return;
5305         }
5306
5307         reply_outbuf(req, 0, 0);
5308
5309         END_PROFILE(SMBlock);
5310         return;
5311 }
5312
5313 /****************************************************************************
5314  Reply to a unlock.
5315 ****************************************************************************/
5316
5317 void reply_unlock(struct smb_request *req)
5318 {
5319         connection_struct *conn = req->conn;
5320         uint64_t count,offset;
5321         NTSTATUS status;
5322         files_struct *fsp;
5323
5324         START_PROFILE(SMBunlock);
5325
5326         if (req->wct < 5) {
5327                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5328                 END_PROFILE(SMBunlock);
5329                 return;
5330         }
5331
5332         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5333
5334         if (!check_fsp(conn, req, fsp)) {
5335                 END_PROFILE(SMBunlock);
5336                 return;
5337         }
5338
5339         count = (uint64_t)IVAL(req->vwv+1, 0);
5340         offset = (uint64_t)IVAL(req->vwv+3, 0);
5341
5342         status = do_unlock(req->sconn->msg_ctx,
5343                         fsp,
5344                         (uint64_t)req->smbpid,
5345                         count,
5346                         offset,
5347                         WINDOWS_LOCK);
5348
5349         if (NT_STATUS_V(status)) {
5350                 reply_nterror(req, status);
5351                 END_PROFILE(SMBunlock);
5352                 return;
5353         }
5354
5355         DEBUG( 3, ( "unlock fd=%d %s offset=%.0f count=%.0f\n",
5356                     fsp->fh->fd, fsp_fnum_dbg(fsp), (double)offset, (double)count ) );
5357
5358         reply_outbuf(req, 0, 0);
5359
5360         END_PROFILE(SMBunlock);
5361         return;
5362 }
5363
5364 #undef DBGC_CLASS
5365 #define DBGC_CLASS DBGC_ALL
5366
5367 /****************************************************************************
5368  Reply to a tdis.
5369  conn POINTER CAN BE NULL HERE !
5370 ****************************************************************************/
5371
5372 void reply_tdis(struct smb_request *req)
5373 {
5374         NTSTATUS status;
5375         connection_struct *conn = req->conn;
5376         struct smbXsrv_tcon *tcon;
5377
5378         START_PROFILE(SMBtdis);
5379
5380         if (!conn) {
5381                 DEBUG(4,("Invalid connection in tdis\n"));
5382                 reply_force_doserror(req, ERRSRV, ERRinvnid);
5383                 END_PROFILE(SMBtdis);
5384                 return;
5385         }
5386
5387         tcon = conn->tcon;
5388         req->conn = NULL;
5389
5390         /*
5391          * TODO: cancel all outstanding requests on the tcon
5392          */
5393         status = smbXsrv_tcon_disconnect(tcon, req->vuid);
5394         if (!NT_STATUS_IS_OK(status)) {
5395                 DEBUG(0, ("reply_tdis: "
5396                           "smbXsrv_tcon_disconnect() failed: %s\n",
5397                           nt_errstr(status)));
5398                 /*
5399                  * If we hit this case, there is something completely
5400                  * wrong, so we better disconnect the transport connection.
5401                  */
5402                 END_PROFILE(SMBtdis);
5403                 exit_server(__location__ ": smbXsrv_tcon_disconnect failed");
5404                 return;
5405         }
5406
5407         TALLOC_FREE(tcon);
5408
5409         reply_outbuf(req, 0, 0);
5410         END_PROFILE(SMBtdis);
5411         return;
5412 }
5413
5414 /****************************************************************************
5415  Reply to a echo.
5416  conn POINTER CAN BE NULL HERE !
5417 ****************************************************************************/
5418
5419 void reply_echo(struct smb_request *req)
5420 {
5421         connection_struct *conn = req->conn;
5422         struct smb_perfcount_data local_pcd;
5423         struct smb_perfcount_data *cur_pcd;
5424         int smb_reverb;
5425         int seq_num;
5426
5427         START_PROFILE(SMBecho);
5428
5429         smb_init_perfcount_data(&local_pcd);
5430
5431         if (req->wct < 1) {
5432                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5433                 END_PROFILE(SMBecho);
5434                 return;
5435         }
5436
5437         smb_reverb = SVAL(req->vwv+0, 0);
5438
5439         reply_outbuf(req, 1, req->buflen);
5440
5441         /* copy any incoming data back out */
5442         if (req->buflen > 0) {
5443                 memcpy(smb_buf(req->outbuf), req->buf, req->buflen);
5444         }
5445
5446         if (smb_reverb > 100) {
5447                 DEBUG(0,("large reverb (%d)?? Setting to 100\n",smb_reverb));
5448                 smb_reverb = 100;
5449         }
5450
5451         for (seq_num = 1 ; seq_num <= smb_reverb ; seq_num++) {
5452
5453                 /* this makes sure we catch the request pcd */
5454                 if (seq_num == smb_reverb) {
5455                         cur_pcd = &req->pcd;
5456                 } else {
5457                         SMB_PERFCOUNT_COPY_CONTEXT(&req->pcd, &local_pcd);
5458                         cur_pcd = &local_pcd;
5459                 }
5460
5461                 SSVAL(req->outbuf,smb_vwv0,seq_num);
5462
5463                 show_msg((char *)req->outbuf);
5464                 if (!srv_send_smb(req->sconn,
5465                                 (char *)req->outbuf,
5466                                 true, req->seqnum+1,
5467                                 IS_CONN_ENCRYPTED(conn)||req->encrypted,
5468                                 cur_pcd))
5469                         exit_server_cleanly("reply_echo: srv_send_smb failed.");
5470         }
5471
5472         DEBUG(3,("echo %d times\n", smb_reverb));
5473
5474         TALLOC_FREE(req->outbuf);
5475
5476         END_PROFILE(SMBecho);
5477         return;
5478 }
5479
5480 /****************************************************************************
5481  Reply to a printopen.
5482 ****************************************************************************/
5483
5484 void reply_printopen(struct smb_request *req)
5485 {
5486         connection_struct *conn = req->conn;
5487         files_struct *fsp;
5488         NTSTATUS status;
5489
5490         START_PROFILE(SMBsplopen);
5491
5492         if (req->wct < 2) {
5493                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5494                 END_PROFILE(SMBsplopen);
5495                 return;
5496         }
5497
5498         if (!CAN_PRINT(conn)) {
5499                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5500                 END_PROFILE(SMBsplopen);
5501                 return;
5502         }
5503
5504         status = file_new(req, conn, &fsp);
5505         if(!NT_STATUS_IS_OK(status)) {
5506                 reply_nterror(req, status);
5507                 END_PROFILE(SMBsplopen);
5508                 return;
5509         }
5510
5511         /* Open for exclusive use, write only. */
5512         status = print_spool_open(fsp, NULL, req->vuid);
5513
5514         if (!NT_STATUS_IS_OK(status)) {
5515                 file_free(req, fsp);
5516                 reply_nterror(req, status);
5517                 END_PROFILE(SMBsplopen);
5518                 return;
5519         }
5520
5521         reply_outbuf(req, 1, 0);
5522         SSVAL(req->outbuf,smb_vwv0,fsp->fnum);
5523
5524         DEBUG(3,("openprint fd=%d %s\n",
5525                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5526
5527         END_PROFILE(SMBsplopen);
5528         return;
5529 }
5530
5531 /****************************************************************************
5532  Reply to a printclose.
5533 ****************************************************************************/
5534
5535 void reply_printclose(struct smb_request *req)
5536 {
5537         connection_struct *conn = req->conn;
5538         files_struct *fsp;
5539         NTSTATUS status;
5540
5541         START_PROFILE(SMBsplclose);
5542
5543         if (req->wct < 1) {
5544                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5545                 END_PROFILE(SMBsplclose);
5546                 return;
5547         }
5548
5549         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5550
5551         if (!check_fsp(conn, req, fsp)) {
5552                 END_PROFILE(SMBsplclose);
5553                 return;
5554         }
5555
5556         if (!CAN_PRINT(conn)) {
5557                 reply_force_doserror(req, ERRSRV, ERRerror);
5558                 END_PROFILE(SMBsplclose);
5559                 return;
5560         }
5561
5562         DEBUG(3,("printclose fd=%d %s\n",
5563                  fsp->fh->fd, fsp_fnum_dbg(fsp)));
5564
5565         status = close_file(req, fsp, NORMAL_CLOSE);
5566
5567         if(!NT_STATUS_IS_OK(status)) {
5568                 reply_nterror(req, status);
5569                 END_PROFILE(SMBsplclose);
5570                 return;
5571         }
5572
5573         reply_outbuf(req, 0, 0);
5574
5575         END_PROFILE(SMBsplclose);
5576         return;
5577 }
5578
5579 /****************************************************************************
5580  Reply to a printqueue.
5581 ****************************************************************************/
5582
5583 void reply_printqueue(struct smb_request *req)
5584 {
5585         connection_struct *conn = req->conn;
5586         int max_count;
5587         int start_index;
5588
5589         START_PROFILE(SMBsplretq);
5590
5591         if (req->wct < 2) {
5592                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5593                 END_PROFILE(SMBsplretq);
5594                 return;
5595         }
5596
5597         max_count = SVAL(req->vwv+0, 0);
5598         start_index = SVAL(req->vwv+1, 0);
5599
5600         /* we used to allow the client to get the cnum wrong, but that
5601            is really quite gross and only worked when there was only
5602            one printer - I think we should now only accept it if they
5603            get it right (tridge) */
5604         if (!CAN_PRINT(conn)) {
5605                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5606                 END_PROFILE(SMBsplretq);
5607                 return;
5608         }
5609
5610         reply_outbuf(req, 2, 3);
5611         SSVAL(req->outbuf,smb_vwv0,0);
5612         SSVAL(req->outbuf,smb_vwv1,0);
5613         SCVAL(smb_buf(req->outbuf),0,1);
5614         SSVAL(smb_buf(req->outbuf),1,0);
5615
5616         DEBUG(3,("printqueue start_index=%d max_count=%d\n",
5617                  start_index, max_count));
5618
5619         {
5620                 TALLOC_CTX *mem_ctx = talloc_tos();
5621                 NTSTATUS status;
5622                 WERROR werr;
5623                 const char *sharename = lp_servicename(mem_ctx, SNUM(conn));
5624                 struct rpc_pipe_client *cli = NULL;
5625                 struct dcerpc_binding_handle *b = NULL;
5626                 struct policy_handle handle;
5627                 struct spoolss_DevmodeContainer devmode_ctr;
5628                 union spoolss_JobInfo *info;
5629                 uint32_t count;
5630                 uint32_t num_to_get;
5631                 uint32_t first;
5632                 uint32_t i;
5633
5634                 ZERO_STRUCT(handle);
5635
5636                 status = rpc_pipe_open_interface(conn,
5637                                                  &ndr_table_spoolss.syntax_id,
5638                                                  conn->session_info,
5639                                                  conn->sconn->remote_address,
5640                                                  conn->sconn->msg_ctx,
5641                                                  &cli);
5642                 if (!NT_STATUS_IS_OK(status)) {
5643                         DEBUG(0, ("reply_printqueue: "
5644                                   "could not connect to spoolss: %s\n",
5645                                   nt_errstr(status)));
5646                         reply_nterror(req, status);
5647                         goto out;
5648                 }
5649                 b = cli->binding_handle;
5650
5651                 ZERO_STRUCT(devmode_ctr);
5652
5653                 status = dcerpc_spoolss_OpenPrinter(b, mem_ctx,
5654                                                 sharename,
5655                                                 NULL, devmode_ctr,
5656                                                 SEC_FLAG_MAXIMUM_ALLOWED,
5657                                                 &handle,
5658                                                 &werr);
5659                 if (!NT_STATUS_IS_OK(status)) {
5660                         reply_nterror(req, status);
5661                         goto out;
5662                 }
5663                 if (!W_ERROR_IS_OK(werr)) {
5664                         reply_nterror(req, werror_to_ntstatus(werr));
5665                         goto out;
5666                 }
5667
5668                 werr = rpccli_spoolss_enumjobs(cli, mem_ctx,
5669                                                &handle,
5670                                                0, /* firstjob */
5671                                                0xff, /* numjobs */
5672                                                2, /* level */
5673                                                0, /* offered */
5674                                                &count,
5675                                                &info);
5676                 if (!W_ERROR_IS_OK(werr)) {
5677                         reply_nterror(req, werror_to_ntstatus(werr));
5678                         goto out;
5679                 }
5680
5681                 if (max_count > 0) {
5682                         first = start_index;
5683                 } else {
5684                         first = start_index + max_count + 1;
5685                 }
5686
5687                 if (first >= count) {
5688                         num_to_get = first;
5689                 } else {
5690                         num_to_get = first + MIN(ABS(max_count), count - first);
5691                 }
5692
5693                 for (i = first; i < num_to_get; i++) {
5694                         char blob[28];
5695                         char *p = blob;
5696                         time_t qtime = spoolss_Time_to_time_t(&info[i].info2.submitted);
5697                         int qstatus;
5698                         uint16_t qrapjobid = pjobid_to_rap(sharename,
5699                                                         info[i].info2.job_id);
5700
5701                         if (info[i].info2.status == JOB_STATUS_PRINTING) {
5702                                 qstatus = 2;
5703                         } else {
5704                                 qstatus = 3;
5705                         }
5706
5707                         srv_put_dos_date2(p, 0, qtime);
5708                         SCVAL(p, 4, qstatus);
5709                         SSVAL(p, 5, qrapjobid);
5710                         SIVAL(p, 7, info[i].info2.size);
5711                         SCVAL(p, 11, 0);
5712                         srvstr_push(blob, req->flags2, p+12,
5713                                     info[i].info2.notify_name, 16, STR_ASCII);
5714
5715                         if (message_push_blob(
5716                                     &req->outbuf,
5717                                     data_blob_const(
5718                                             blob, sizeof(blob))) == -1) {
5719                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
5720                                 goto out;
5721                         }
5722                 }
5723
5724                 if (count > 0) {
5725                         SSVAL(req->outbuf,smb_vwv0,count);
5726                         SSVAL(req->outbuf,smb_vwv1,
5727                               (max_count>0?first+count:first-1));
5728                         SCVAL(smb_buf(req->outbuf),0,1);
5729                         SSVAL(smb_buf(req->outbuf),1,28*count);
5730                 }
5731
5732
5733                 DEBUG(3, ("%u entries returned in queue\n",
5734                           (unsigned)count));
5735
5736 out:
5737                 if (b && is_valid_policy_hnd(&handle)) {
5738                         dcerpc_spoolss_ClosePrinter(b, mem_ctx, &handle, &werr);
5739                 }
5740
5741         }
5742
5743         END_PROFILE(SMBsplretq);
5744         return;
5745 }
5746
5747 /****************************************************************************
5748  Reply to a printwrite.
5749 ****************************************************************************/
5750
5751 void reply_printwrite(struct smb_request *req)
5752 {
5753         connection_struct *conn = req->conn;
5754         int numtowrite;
5755         const char *data;
5756         files_struct *fsp;
5757
5758         START_PROFILE(SMBsplwr);
5759
5760         if (req->wct < 1) {
5761                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5762                 END_PROFILE(SMBsplwr);
5763                 return;
5764         }
5765
5766         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
5767
5768         if (!check_fsp(conn, req, fsp)) {
5769                 END_PROFILE(SMBsplwr);
5770                 return;
5771         }
5772
5773         if (!fsp->print_file) {
5774                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5775                 END_PROFILE(SMBsplwr);
5776                 return;
5777         }
5778
5779         if (!CHECK_WRITE(fsp)) {
5780                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5781                 END_PROFILE(SMBsplwr);
5782                 return;
5783         }
5784
5785         numtowrite = SVAL(req->buf, 1);
5786
5787         if (req->buflen < numtowrite + 3) {
5788                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
5789                 END_PROFILE(SMBsplwr);
5790                 return;
5791         }
5792
5793         data = (const char *)req->buf + 3;
5794
5795         if (write_file(req,fsp,data,(off_t)-1,numtowrite) != numtowrite) {
5796                 reply_nterror(req, map_nt_error_from_unix(errno));
5797                 END_PROFILE(SMBsplwr);
5798                 return;
5799         }
5800
5801         DEBUG(3, ("printwrite %s num=%d\n", fsp_fnum_dbg(fsp), numtowrite));
5802
5803         END_PROFILE(SMBsplwr);
5804         return;
5805 }
5806
5807 /****************************************************************************
5808  Reply to a mkdir.
5809 ****************************************************************************/
5810
5811 void reply_mkdir(struct smb_request *req)
5812 {
5813         connection_struct *conn = req->conn;
5814         struct smb_filename *smb_dname = NULL;
5815         char *directory = NULL;
5816         NTSTATUS status;
5817         TALLOC_CTX *ctx = talloc_tos();
5818
5819         START_PROFILE(SMBmkdir);
5820
5821         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5822                             STR_TERMINATE, &status);
5823         if (!NT_STATUS_IS_OK(status)) {
5824                 reply_nterror(req, status);
5825                 goto out;
5826         }
5827
5828         status = filename_convert(ctx, conn,
5829                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5830                                  directory,
5831                                  UCF_PREP_CREATEFILE,
5832                                  NULL,
5833                                  &smb_dname);
5834         if (!NT_STATUS_IS_OK(status)) {
5835                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5836                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5837                                         ERRSRV, ERRbadpath);
5838                         goto out;
5839                 }
5840                 reply_nterror(req, status);
5841                 goto out;
5842         }
5843
5844         status = create_directory(conn, req, smb_dname);
5845
5846         DEBUG(5, ("create_directory returned %s\n", nt_errstr(status)));
5847
5848         if (!NT_STATUS_IS_OK(status)) {
5849
5850                 if (!use_nt_status()
5851                     && NT_STATUS_EQUAL(status,
5852                                        NT_STATUS_OBJECT_NAME_COLLISION)) {
5853                         /*
5854                          * Yes, in the DOS error code case we get a
5855                          * ERRDOS:ERRnoaccess here. See BASE-SAMBA3ERROR
5856                          * samba4 torture test.
5857                          */
5858                         status = NT_STATUS_DOS(ERRDOS, ERRnoaccess);
5859                 }
5860
5861                 reply_nterror(req, status);
5862                 goto out;
5863         }
5864
5865         reply_outbuf(req, 0, 0);
5866
5867         DEBUG(3, ("mkdir %s\n", smb_dname->base_name));
5868  out:
5869         TALLOC_FREE(smb_dname);
5870         END_PROFILE(SMBmkdir);
5871         return;
5872 }
5873
5874 /****************************************************************************
5875  Reply to a rmdir.
5876 ****************************************************************************/
5877
5878 void reply_rmdir(struct smb_request *req)
5879 {
5880         connection_struct *conn = req->conn;
5881         struct smb_filename *smb_dname = NULL;
5882         char *directory = NULL;
5883         NTSTATUS status;
5884         TALLOC_CTX *ctx = talloc_tos();
5885         files_struct *fsp = NULL;
5886         int info = 0;
5887         struct smbd_server_connection *sconn = req->sconn;
5888
5889         START_PROFILE(SMBrmdir);
5890
5891         srvstr_get_path_req(ctx, req, &directory, (const char *)req->buf + 1,
5892                             STR_TERMINATE, &status);
5893         if (!NT_STATUS_IS_OK(status)) {
5894                 reply_nterror(req, status);
5895                 goto out;
5896         }
5897
5898         status = filename_convert(ctx, conn,
5899                                  req->flags2 & FLAGS2_DFS_PATHNAMES,
5900                                  directory,
5901                                  0,
5902                                  NULL,
5903                                  &smb_dname);
5904         if (!NT_STATUS_IS_OK(status)) {
5905                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
5906                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
5907                                         ERRSRV, ERRbadpath);
5908                         goto out;
5909                 }
5910                 reply_nterror(req, status);
5911                 goto out;
5912         }
5913
5914         if (is_ntfs_stream_smb_fname(smb_dname)) {
5915                 reply_nterror(req, NT_STATUS_NOT_A_DIRECTORY);
5916                 goto out;
5917         }
5918
5919         status = SMB_VFS_CREATE_FILE(
5920                 conn,                                   /* conn */
5921                 req,                                    /* req */
5922                 0,                                      /* root_dir_fid */
5923                 smb_dname,                              /* fname */
5924                 DELETE_ACCESS,                          /* access_mask */
5925                 (FILE_SHARE_READ | FILE_SHARE_WRITE |   /* share_access */
5926                         FILE_SHARE_DELETE),
5927                 FILE_OPEN,                              /* create_disposition*/
5928                 FILE_DIRECTORY_FILE,                    /* create_options */
5929                 FILE_ATTRIBUTE_DIRECTORY,               /* file_attributes */
5930                 0,                                      /* oplock_request */
5931                 0,                                      /* allocation_size */
5932                 0,                                      /* private_flags */
5933                 NULL,                                   /* sd */
5934                 NULL,                                   /* ea_list */
5935                 &fsp,                                   /* result */
5936                 &info);                                 /* pinfo */
5937
5938         if (!NT_STATUS_IS_OK(status)) {
5939                 if (open_was_deferred(req->sconn, req->mid)) {
5940                         /* We have re-scheduled this call. */
5941                         goto out;
5942                 }
5943                 reply_nterror(req, status);
5944                 goto out;
5945         }
5946
5947         status = can_set_delete_on_close(fsp, FILE_ATTRIBUTE_DIRECTORY);
5948         if (!NT_STATUS_IS_OK(status)) {
5949                 close_file(req, fsp, ERROR_CLOSE);
5950                 reply_nterror(req, status);
5951                 goto out;
5952         }
5953
5954         if (!set_delete_on_close(fsp, true,
5955                         conn->session_info->security_token,
5956                         conn->session_info->unix_token)) {
5957                 close_file(req, fsp, ERROR_CLOSE);
5958                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
5959                 goto out;
5960         }
5961
5962         status = close_file(req, fsp, NORMAL_CLOSE);
5963         if (!NT_STATUS_IS_OK(status)) {
5964                 reply_nterror(req, status);
5965         } else {
5966                 reply_outbuf(req, 0, 0);
5967         }
5968
5969         dptr_closepath(sconn, smb_dname->base_name, req->smbpid);
5970
5971         DEBUG(3, ("rmdir %s\n", smb_fname_str_dbg(smb_dname)));
5972  out:
5973         TALLOC_FREE(smb_dname);
5974         END_PROFILE(SMBrmdir);
5975         return;
5976 }
5977
5978 /*******************************************************************
5979  Resolve wildcards in a filename rename.
5980 ********************************************************************/
5981
5982 static bool resolve_wildcards(TALLOC_CTX *ctx,
5983                                 const char *name1,
5984                                 const char *name2,
5985                                 char **pp_newname)
5986 {
5987         char *name2_copy = NULL;
5988         char *root1 = NULL;
5989         char *root2 = NULL;
5990         char *ext1 = NULL;
5991         char *ext2 = NULL;
5992         char *p,*p2, *pname1, *pname2;
5993
5994         name2_copy = talloc_strdup(ctx, name2);
5995         if (!name2_copy) {
5996                 return False;
5997         }
5998
5999         pname1 = strrchr_m(name1,'/');
6000         pname2 = strrchr_m(name2_copy,'/');
6001
6002         if (!pname1 || !pname2) {
6003                 return False;
6004         }
6005
6006         /* Truncate the copy of name2 at the last '/' */
6007         *pname2 = '\0';
6008
6009         /* Now go past the '/' */
6010         pname1++;
6011         pname2++;
6012
6013         root1 = talloc_strdup(ctx, pname1);
6014         root2 = talloc_strdup(ctx, pname2);
6015
6016         if (!root1 || !root2) {
6017                 return False;
6018         }
6019
6020         p = strrchr_m(root1,'.');
6021         if (p) {
6022                 *p = 0;
6023                 ext1 = talloc_strdup(ctx, p+1);
6024         } else {
6025                 ext1 = talloc_strdup(ctx, "");
6026         }
6027         p = strrchr_m(root2,'.');
6028         if (p) {
6029                 *p = 0;
6030                 ext2 = talloc_strdup(ctx, p+1);
6031         } else {
6032                 ext2 = talloc_strdup(ctx, "");
6033         }
6034
6035         if (!ext1 || !ext2) {
6036                 return False;
6037         }
6038
6039         p = root1;
6040         p2 = root2;
6041         while (*p2) {
6042                 if (*p2 == '?') {
6043                         /* Hmmm. Should this be mb-aware ? */
6044                         *p2 = *p;
6045                         p2++;
6046                 } else if (*p2 == '*') {
6047                         *p2 = '\0';
6048                         root2 = talloc_asprintf(ctx, "%s%s",
6049                                                 root2,
6050                                                 p);
6051                         if (!root2) {
6052                                 return False;
6053                         }
6054                         break;
6055                 } else {
6056                         p2++;
6057                 }
6058                 if (*p) {
6059                         p++;
6060                 }
6061         }
6062
6063         p = ext1;
6064         p2 = ext2;
6065         while (*p2) {
6066                 if (*p2 == '?') {
6067                         /* Hmmm. Should this be mb-aware ? */
6068                         *p2 = *p;
6069                         p2++;
6070                 } else if (*p2 == '*') {
6071                         *p2 = '\0';
6072                         ext2 = talloc_asprintf(ctx, "%s%s",
6073                                                 ext2,
6074                                                 p);
6075                         if (!ext2) {
6076                                 return False;
6077                         }
6078                         break;
6079                 } else {
6080                         p2++;
6081                 }
6082                 if (*p) {
6083                         p++;
6084                 }
6085         }
6086
6087         if (*ext2) {
6088                 *pp_newname = talloc_asprintf(ctx, "%s/%s.%s",
6089                                 name2_copy,
6090                                 root2,
6091                                 ext2);
6092         } else {
6093                 *pp_newname = talloc_asprintf(ctx, "%s/%s",
6094                                 name2_copy,
6095                                 root2);
6096         }
6097
6098         if (!*pp_newname) {
6099                 return False;
6100         }
6101
6102         return True;
6103 }
6104
6105 /****************************************************************************
6106  Ensure open files have their names updated. Updated to notify other smbd's
6107  asynchronously.
6108 ****************************************************************************/
6109
6110 static void rename_open_files(connection_struct *conn,
6111                               struct share_mode_lock *lck,
6112                               uint32_t orig_name_hash,
6113                               const struct smb_filename *smb_fname_dst)
6114 {
6115         files_struct *fsp;
6116         bool did_rename = False;
6117         NTSTATUS status;
6118         uint32_t new_name_hash = 0;
6119
6120         for(fsp = file_find_di_first(conn->sconn, lck->data->id); fsp;
6121             fsp = file_find_di_next(fsp)) {
6122                 /* fsp_name is a relative path under the fsp. To change this for other
6123                    sharepaths we need to manipulate relative paths. */
6124                 /* TODO - create the absolute path and manipulate the newname
6125                    relative to the sharepath. */
6126                 if (!strequal(fsp->conn->connectpath, conn->connectpath)) {
6127                         continue;
6128                 }
6129                 if (fsp->name_hash != orig_name_hash) {
6130                         continue;
6131                 }
6132                 DEBUG(10, ("rename_open_files: renaming file %s "
6133                            "(file_id %s) from %s -> %s\n", fsp_fnum_dbg(fsp),
6134                            file_id_string_tos(&fsp->file_id), fsp_str_dbg(fsp),
6135                            smb_fname_str_dbg(smb_fname_dst)));
6136
6137                 status = fsp_set_smb_fname(fsp, smb_fname_dst);
6138                 if (NT_STATUS_IS_OK(status)) {
6139                         did_rename = True;
6140                         new_name_hash = fsp->name_hash;
6141                 }
6142         }
6143
6144         if (!did_rename) {
6145                 DEBUG(10, ("rename_open_files: no open files on file_id %s "
6146                            "for %s\n", file_id_string_tos(&lck->data->id),
6147                            smb_fname_str_dbg(smb_fname_dst)));
6148         }
6149
6150         /* Send messages to all smbd's (not ourself) that the name has changed. */
6151         rename_share_filename(conn->sconn->msg_ctx, lck, conn->connectpath,
6152                               orig_name_hash, new_name_hash,
6153                               smb_fname_dst);
6154
6155 }
6156
6157 /****************************************************************************
6158  We need to check if the source path is a parent directory of the destination
6159  (ie. a rename of /foo/bar/baz -> /foo/bar/baz/bibble/bobble. If so we must
6160  refuse the rename with a sharing violation. Under UNIX the above call can
6161  *succeed* if /foo/bar/baz is a symlink to another area in the share. We
6162  probably need to check that the client is a Windows one before disallowing
6163  this as a UNIX client (one with UNIX extensions) can know the source is a
6164  symlink and make this decision intelligently. Found by an excellent bug
6165  report from <AndyLiebman@aol.com>.
6166 ****************************************************************************/
6167
6168 static bool rename_path_prefix_equal(const struct smb_filename *smb_fname_src,
6169                                      const struct smb_filename *smb_fname_dst)
6170 {
6171         const char *psrc = smb_fname_src->base_name;
6172         const char *pdst = smb_fname_dst->base_name;
6173         size_t slen;
6174
6175         if (psrc[0] == '.' && psrc[1] == '/') {
6176                 psrc += 2;
6177         }
6178         if (pdst[0] == '.' && pdst[1] == '/') {
6179                 pdst += 2;
6180         }
6181         if ((slen = strlen(psrc)) > strlen(pdst)) {
6182                 return False;
6183         }
6184         return ((memcmp(psrc, pdst, slen) == 0) && pdst[slen] == '/');
6185 }
6186
6187 /*
6188  * Do the notify calls from a rename
6189  */
6190
6191 static void notify_rename(connection_struct *conn, bool is_dir,
6192                           const struct smb_filename *smb_fname_src,
6193                           const struct smb_filename *smb_fname_dst)
6194 {
6195         char *parent_dir_src = NULL;
6196         char *parent_dir_dst = NULL;
6197         uint32 mask;
6198
6199         mask = is_dir ? FILE_NOTIFY_CHANGE_DIR_NAME
6200                 : FILE_NOTIFY_CHANGE_FILE_NAME;
6201
6202         if (!parent_dirname(talloc_tos(), smb_fname_src->base_name,
6203                             &parent_dir_src, NULL) ||
6204             !parent_dirname(talloc_tos(), smb_fname_dst->base_name,
6205                             &parent_dir_dst, NULL)) {
6206                 goto out;
6207         }
6208
6209         if (strcmp(parent_dir_src, parent_dir_dst) == 0) {
6210                 notify_fname(conn, NOTIFY_ACTION_OLD_NAME, mask,
6211                              smb_fname_src->base_name);
6212                 notify_fname(conn, NOTIFY_ACTION_NEW_NAME, mask,
6213                              smb_fname_dst->base_name);
6214         }
6215         else {
6216                 notify_fname(conn, NOTIFY_ACTION_REMOVED, mask,
6217                              smb_fname_src->base_name);
6218                 notify_fname(conn, NOTIFY_ACTION_ADDED, mask,
6219                              smb_fname_dst->base_name);
6220         }
6221
6222         /* this is a strange one. w2k3 gives an additional event for
6223            CHANGE_ATTRIBUTES and CHANGE_CREATION on the new file when renaming
6224            files, but not directories */
6225         if (!is_dir) {
6226                 notify_fname(conn, NOTIFY_ACTION_MODIFIED,
6227                              FILE_NOTIFY_CHANGE_ATTRIBUTES
6228                              |FILE_NOTIFY_CHANGE_CREATION,
6229                              smb_fname_dst->base_name);
6230         }
6231  out:
6232         TALLOC_FREE(parent_dir_src);
6233         TALLOC_FREE(parent_dir_dst);
6234 }
6235
6236 /****************************************************************************
6237  Returns an error if the parent directory for a filename is open in an
6238  incompatible way.
6239 ****************************************************************************/
6240
6241 static NTSTATUS parent_dirname_compatible_open(connection_struct *conn,
6242                                         const struct smb_filename *smb_fname_dst_in)
6243 {
6244         char *parent_dir = NULL;
6245         struct smb_filename smb_fname_parent;
6246         struct file_id id;
6247         files_struct *fsp = NULL;
6248         int ret;
6249
6250         if (!parent_dirname(talloc_tos(), smb_fname_dst_in->base_name,
6251                         &parent_dir, NULL)) {
6252                 return NT_STATUS_NO_MEMORY;
6253         }
6254         ZERO_STRUCT(smb_fname_parent);
6255         smb_fname_parent.base_name = parent_dir;
6256
6257         ret = SMB_VFS_LSTAT(conn, &smb_fname_parent);
6258         if (ret == -1) {
6259                 return map_nt_error_from_unix(errno);
6260         }
6261
6262         /*
6263          * We're only checking on this smbd here, mostly good
6264          * enough.. and will pass tests.
6265          */
6266
6267         id = vfs_file_id_from_sbuf(conn, &smb_fname_parent.st);
6268         for (fsp = file_find_di_first(conn->sconn, id); fsp;
6269                         fsp = file_find_di_next(fsp)) {
6270                 if (fsp->access_mask & DELETE_ACCESS) {
6271                         return NT_STATUS_SHARING_VIOLATION;
6272                 }
6273         }
6274         return NT_STATUS_OK;
6275 }
6276
6277 /****************************************************************************
6278  Rename an open file - given an fsp.
6279 ****************************************************************************/
6280
6281 NTSTATUS rename_internals_fsp(connection_struct *conn,
6282                         files_struct *fsp,
6283                         const struct smb_filename *smb_fname_dst_in,
6284                         uint32 attrs,
6285                         bool replace_if_exists)
6286 {
6287         TALLOC_CTX *ctx = talloc_tos();
6288         struct smb_filename *smb_fname_dst = NULL;
6289         NTSTATUS status = NT_STATUS_OK;
6290         struct share_mode_lock *lck = NULL;
6291         bool dst_exists, old_is_stream, new_is_stream;
6292
6293         status = check_name(conn, smb_fname_dst_in->base_name);
6294         if (!NT_STATUS_IS_OK(status)) {
6295                 return status;
6296         }
6297
6298         status = parent_dirname_compatible_open(conn, smb_fname_dst_in);
6299         if (!NT_STATUS_IS_OK(status)) {
6300                 return status;
6301         }
6302
6303         /* Make a copy of the dst smb_fname structs */
6304
6305         smb_fname_dst = cp_smb_filename(ctx, smb_fname_dst_in);
6306         if (smb_fname_dst == NULL) {
6307                 status = NT_STATUS_NO_MEMORY;
6308                 goto out;
6309         }
6310
6311         /*
6312          * Check for special case with case preserving and not
6313          * case sensitive. If the old last component differs from the original
6314          * last component only by case, then we should allow
6315          * the rename (user is trying to change the case of the
6316          * filename).
6317          */
6318         if((conn->case_sensitive == False) && (conn->case_preserve == True) &&
6319             strequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6320             strequal(fsp->fsp_name->stream_name, smb_fname_dst->stream_name)) {
6321                 char *last_slash;
6322                 char *fname_dst_lcomp_base_mod = NULL;
6323                 struct smb_filename *smb_fname_orig_lcomp = NULL;
6324
6325                 /*
6326                  * Get the last component of the destination name.
6327                  */
6328                 last_slash = strrchr_m(smb_fname_dst->base_name, '/');
6329                 if (last_slash) {
6330                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, last_slash + 1);
6331                 } else {
6332                         fname_dst_lcomp_base_mod = talloc_strdup(ctx, smb_fname_dst->base_name);
6333                 }
6334                 if (!fname_dst_lcomp_base_mod) {
6335                         status = NT_STATUS_NO_MEMORY;
6336                         goto out;
6337                 }
6338
6339                 /*
6340                  * Create an smb_filename struct using the original last
6341                  * component of the destination.
6342                  */
6343                 smb_fname_orig_lcomp = synthetic_smb_fname_split(
6344                         ctx, smb_fname_dst->original_lcomp, NULL);
6345                 if (smb_fname_orig_lcomp == NULL) {
6346                         status = NT_STATUS_NO_MEMORY;
6347                         TALLOC_FREE(fname_dst_lcomp_base_mod);
6348                         goto out;
6349                 }
6350
6351                 /* If the base names only differ by case, use original. */
6352                 if(!strcsequal(fname_dst_lcomp_base_mod,
6353                                smb_fname_orig_lcomp->base_name)) {
6354                         char *tmp;
6355                         /*
6356                          * Replace the modified last component with the
6357                          * original.
6358                          */
6359                         if (last_slash) {
6360                                 *last_slash = '\0'; /* Truncate at the '/' */
6361                                 tmp = talloc_asprintf(smb_fname_dst,
6362                                         "%s/%s",
6363                                         smb_fname_dst->base_name,
6364                                         smb_fname_orig_lcomp->base_name);
6365                         } else {
6366                                 tmp = talloc_asprintf(smb_fname_dst,
6367                                         "%s",
6368                                         smb_fname_orig_lcomp->base_name);
6369                         }
6370                         if (tmp == NULL) {
6371                                 status = NT_STATUS_NO_MEMORY;
6372                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6373                                 TALLOC_FREE(smb_fname_orig_lcomp);
6374                                 goto out;
6375                         }
6376                         TALLOC_FREE(smb_fname_dst->base_name);
6377                         smb_fname_dst->base_name = tmp;
6378                 }
6379
6380                 /* If the stream_names only differ by case, use original. */
6381                 if(!strcsequal(smb_fname_dst->stream_name,
6382                                smb_fname_orig_lcomp->stream_name)) {
6383                         char *tmp = NULL;
6384                         /* Use the original stream. */
6385                         tmp = talloc_strdup(smb_fname_dst,
6386                                             smb_fname_orig_lcomp->stream_name);
6387                         if (tmp == NULL) {
6388                                 status = NT_STATUS_NO_MEMORY;
6389                                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6390                                 TALLOC_FREE(smb_fname_orig_lcomp);
6391                                 goto out;
6392                         }
6393                         TALLOC_FREE(smb_fname_dst->stream_name);
6394                         smb_fname_dst->stream_name = tmp;
6395                 }
6396                 TALLOC_FREE(fname_dst_lcomp_base_mod);
6397                 TALLOC_FREE(smb_fname_orig_lcomp);
6398         }
6399
6400         /*
6401          * If the src and dest names are identical - including case,
6402          * don't do the rename, just return success.
6403          */
6404
6405         if (strcsequal(fsp->fsp_name->base_name, smb_fname_dst->base_name) &&
6406             strcsequal(fsp->fsp_name->stream_name,
6407                        smb_fname_dst->stream_name)) {
6408                 DEBUG(3, ("rename_internals_fsp: identical names in rename %s "
6409                           "- returning success\n",
6410                           smb_fname_str_dbg(smb_fname_dst)));
6411                 status = NT_STATUS_OK;
6412                 goto out;
6413         }
6414
6415         old_is_stream = is_ntfs_stream_smb_fname(fsp->fsp_name);
6416         new_is_stream = is_ntfs_stream_smb_fname(smb_fname_dst);
6417
6418         /* Return the correct error code if both names aren't streams. */
6419         if (!old_is_stream && new_is_stream) {
6420                 status = NT_STATUS_OBJECT_NAME_INVALID;
6421                 goto out;
6422         }
6423
6424         if (old_is_stream && !new_is_stream) {
6425                 status = NT_STATUS_INVALID_PARAMETER;
6426                 goto out;
6427         }
6428
6429         dst_exists = SMB_VFS_STAT(conn, smb_fname_dst) == 0;
6430
6431         if(!replace_if_exists && dst_exists) {
6432                 DEBUG(3, ("rename_internals_fsp: dest exists doing rename "
6433                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6434                           smb_fname_str_dbg(smb_fname_dst)));
6435                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6436                 goto out;
6437         }
6438
6439         if (dst_exists) {
6440                 struct file_id fileid = vfs_file_id_from_sbuf(conn,
6441                     &smb_fname_dst->st);
6442                 files_struct *dst_fsp = file_find_di_first(conn->sconn,
6443                                                            fileid);
6444                 /* The file can be open when renaming a stream */
6445                 if (dst_fsp && !new_is_stream) {
6446                         DEBUG(3, ("rename_internals_fsp: Target file open\n"));
6447                         status = NT_STATUS_ACCESS_DENIED;
6448                         goto out;
6449                 }
6450         }
6451
6452         /* Ensure we have a valid stat struct for the source. */
6453         status = vfs_stat_fsp(fsp);
6454         if (!NT_STATUS_IS_OK(status)) {
6455                 goto out;
6456         }
6457
6458         status = can_rename(conn, fsp, attrs);
6459
6460         if (!NT_STATUS_IS_OK(status)) {
6461                 DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6462                           nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6463                           smb_fname_str_dbg(smb_fname_dst)));
6464                 if (NT_STATUS_EQUAL(status,NT_STATUS_SHARING_VIOLATION))
6465                         status = NT_STATUS_ACCESS_DENIED;
6466                 goto out;
6467         }
6468
6469         if (rename_path_prefix_equal(fsp->fsp_name, smb_fname_dst)) {
6470                 status = NT_STATUS_ACCESS_DENIED;
6471         }
6472
6473         lck = get_existing_share_mode_lock(talloc_tos(), fsp->file_id);
6474
6475         /*
6476          * We have the file open ourselves, so not being able to get the
6477          * corresponding share mode lock is a fatal error.
6478          */
6479
6480         SMB_ASSERT(lck != NULL);
6481
6482         if(SMB_VFS_RENAME(conn, fsp->fsp_name, smb_fname_dst) == 0) {
6483                 uint32 create_options = fsp->fh->private_options;
6484
6485                 DEBUG(3, ("rename_internals_fsp: succeeded doing rename on "
6486                           "%s -> %s\n", smb_fname_str_dbg(fsp->fsp_name),
6487                           smb_fname_str_dbg(smb_fname_dst)));
6488
6489                 if (!fsp->is_directory &&
6490                     !lp_posix_pathnames() &&
6491                     (lp_map_archive(SNUM(conn)) ||
6492                     lp_store_dos_attributes(SNUM(conn)))) {
6493                         /* We must set the archive bit on the newly
6494                            renamed file. */
6495                         if (SMB_VFS_STAT(conn, smb_fname_dst) == 0) {
6496                                 uint32_t old_dosmode = dos_mode(conn,
6497                                                         smb_fname_dst);
6498                                 file_set_dosmode(conn,
6499                                         smb_fname_dst,
6500                                         old_dosmode | FILE_ATTRIBUTE_ARCHIVE,
6501                                         NULL,
6502                                         true);
6503                         }
6504                 }
6505
6506                 notify_rename(conn, fsp->is_directory, fsp->fsp_name,
6507                               smb_fname_dst);
6508
6509                 rename_open_files(conn, lck, fsp->name_hash, smb_fname_dst);
6510
6511                 /*
6512                  * A rename acts as a new file create w.r.t. allowing an initial delete
6513                  * on close, probably because in Windows there is a new handle to the
6514                  * new file. If initial delete on close was requested but not
6515                  * originally set, we need to set it here. This is probably not 100% correct,
6516                  * but will work for the CIFSFS client which in non-posix mode
6517                  * depends on these semantics. JRA.
6518                  */
6519
6520                 if (create_options & FILE_DELETE_ON_CLOSE) {
6521                         status = can_set_delete_on_close(fsp, 0);
6522
6523                         if (NT_STATUS_IS_OK(status)) {
6524                                 /* Note that here we set the *inital* delete on close flag,
6525                                  * not the regular one. The magic gets handled in close. */
6526                                 fsp->initial_delete_on_close = True;
6527                         }
6528                 }
6529                 TALLOC_FREE(lck);
6530                 status = NT_STATUS_OK;
6531                 goto out;
6532         }
6533
6534         TALLOC_FREE(lck);
6535
6536         if (errno == ENOTDIR || errno == EISDIR) {
6537                 status = NT_STATUS_OBJECT_NAME_COLLISION;
6538         } else {
6539                 status = map_nt_error_from_unix(errno);
6540         }
6541
6542         DEBUG(3, ("rename_internals_fsp: Error %s rename %s -> %s\n",
6543                   nt_errstr(status), smb_fname_str_dbg(fsp->fsp_name),
6544                   smb_fname_str_dbg(smb_fname_dst)));
6545
6546  out:
6547         TALLOC_FREE(smb_fname_dst);
6548
6549         return status;
6550 }
6551
6552 /****************************************************************************
6553  The guts of the rename command, split out so it may be called by the NT SMB
6554  code.
6555 ****************************************************************************/
6556
6557 NTSTATUS rename_internals(TALLOC_CTX *ctx,
6558                         connection_struct *conn,
6559                         struct smb_request *req,
6560                         struct smb_filename *smb_fname_src,
6561                         struct smb_filename *smb_fname_dst,
6562                         uint32 attrs,
6563                         bool replace_if_exists,
6564                         bool src_has_wild,
6565                         bool dest_has_wild,
6566                         uint32_t access_mask)
6567 {
6568         char *fname_src_dir = NULL;
6569         char *fname_src_mask = NULL;
6570         int count=0;
6571         NTSTATUS status = NT_STATUS_OK;
6572         struct smb_Dir *dir_hnd = NULL;
6573         const char *dname = NULL;
6574         char *talloced = NULL;
6575         long offset = 0;
6576         int create_options = 0;
6577         bool posix_pathnames = lp_posix_pathnames();
6578         int rc;
6579
6580         /*
6581          * Split the old name into directory and last component
6582          * strings. Note that unix_convert may have stripped off a
6583          * leading ./ from both name and newname if the rename is
6584          * at the root of the share. We need to make sure either both
6585          * name and newname contain a / character or neither of them do
6586          * as this is checked in resolve_wildcards().
6587          */
6588
6589         /* Split up the directory from the filename/mask. */
6590         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
6591                                       &fname_src_dir, &fname_src_mask);
6592         if (!NT_STATUS_IS_OK(status)) {
6593                 status = NT_STATUS_NO_MEMORY;
6594                 goto out;
6595         }
6596
6597         /*
6598          * We should only check the mangled cache
6599          * here if unix_convert failed. This means
6600          * that the path in 'mask' doesn't exist
6601          * on the file system and so we need to look
6602          * for a possible mangle. This patch from
6603          * Tine Smukavec <valentin.smukavec@hermes.si>.
6604          */
6605
6606         if (!VALID_STAT(smb_fname_src->st) &&
6607             mangle_is_mangled(fname_src_mask, conn->params)) {
6608                 char *new_mask = NULL;
6609                 mangle_lookup_name_from_8_3(ctx, fname_src_mask, &new_mask,
6610                                             conn->params);
6611                 if (new_mask) {
6612                         TALLOC_FREE(fname_src_mask);
6613                         fname_src_mask = new_mask;
6614                 }
6615         }
6616
6617         if (!src_has_wild) {
6618                 files_struct *fsp;
6619
6620                 /*
6621                  * Only one file needs to be renamed. Append the mask back
6622                  * onto the directory.
6623                  */
6624                 TALLOC_FREE(smb_fname_src->base_name);
6625                 if (ISDOT(fname_src_dir)) {
6626                         /* Ensure we use canonical names on open. */
6627                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6628                                                         "%s",
6629                                                         fname_src_mask);
6630                 } else {
6631                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6632                                                         "%s/%s",
6633                                                         fname_src_dir,
6634                                                         fname_src_mask);
6635                 }
6636                 if (!smb_fname_src->base_name) {
6637                         status = NT_STATUS_NO_MEMORY;
6638                         goto out;
6639                 }
6640
6641                 DEBUG(3, ("rename_internals: case_sensitive = %d, "
6642                           "case_preserve = %d, short case preserve = %d, "
6643                           "directory = %s, newname = %s, "
6644                           "last_component_dest = %s\n",
6645                           conn->case_sensitive, conn->case_preserve,
6646                           conn->short_case_preserve,
6647                           smb_fname_str_dbg(smb_fname_src),
6648                           smb_fname_str_dbg(smb_fname_dst),
6649                           smb_fname_dst->original_lcomp));
6650
6651                 /* The dest name still may have wildcards. */
6652                 if (dest_has_wild) {
6653                         char *fname_dst_mod = NULL;
6654                         if (!resolve_wildcards(smb_fname_dst,
6655                                                smb_fname_src->base_name,
6656                                                smb_fname_dst->base_name,
6657                                                &fname_dst_mod)) {
6658                                 DEBUG(6, ("rename_internals: resolve_wildcards "
6659                                           "%s %s failed\n",
6660                                           smb_fname_src->base_name,
6661                                           smb_fname_dst->base_name));
6662                                 status = NT_STATUS_NO_MEMORY;
6663                                 goto out;
6664                         }
6665                         TALLOC_FREE(smb_fname_dst->base_name);
6666                         smb_fname_dst->base_name = fname_dst_mod;
6667                 }
6668
6669                 ZERO_STRUCT(smb_fname_src->st);
6670                 if (posix_pathnames) {
6671                         rc = SMB_VFS_LSTAT(conn, smb_fname_src);
6672                 } else {
6673                         rc = SMB_VFS_STAT(conn, smb_fname_src);
6674                 }
6675                 if (rc == -1) {
6676                         status = map_nt_error_from_unix_common(errno);
6677                         goto out;
6678                 }
6679
6680                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6681                         create_options |= FILE_DIRECTORY_FILE;
6682                 }
6683
6684                 status = SMB_VFS_CREATE_FILE(
6685                         conn,                           /* conn */
6686                         req,                            /* req */
6687                         0,                              /* root_dir_fid */
6688                         smb_fname_src,                  /* fname */
6689                         access_mask,                    /* access_mask */
6690                         (FILE_SHARE_READ |              /* share_access */
6691                             FILE_SHARE_WRITE),
6692                         FILE_OPEN,                      /* create_disposition*/
6693                         create_options,                 /* create_options */
6694                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6695                         0,                              /* oplock_request */
6696                         0,                              /* allocation_size */
6697                         0,                              /* private_flags */
6698                         NULL,                           /* sd */
6699                         NULL,                           /* ea_list */
6700                         &fsp,                           /* result */
6701                         NULL);                          /* pinfo */
6702
6703                 if (!NT_STATUS_IS_OK(status)) {
6704                         DEBUG(3, ("Could not open rename source %s: %s\n",
6705                                   smb_fname_str_dbg(smb_fname_src),
6706                                   nt_errstr(status)));
6707                         goto out;
6708                 }
6709
6710                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6711                                               attrs, replace_if_exists);
6712
6713                 close_file(req, fsp, NORMAL_CLOSE);
6714
6715                 DEBUG(3, ("rename_internals: Error %s rename %s -> %s\n",
6716                           nt_errstr(status), smb_fname_str_dbg(smb_fname_src),
6717                           smb_fname_str_dbg(smb_fname_dst)));
6718
6719                 goto out;
6720         }
6721
6722         /*
6723          * Wildcards - process each file that matches.
6724          */
6725         if (strequal(fname_src_mask, "????????.???")) {
6726                 TALLOC_FREE(fname_src_mask);
6727                 fname_src_mask = talloc_strdup(ctx, "*");
6728                 if (!fname_src_mask) {
6729                         status = NT_STATUS_NO_MEMORY;
6730                         goto out;
6731                 }
6732         }
6733
6734         status = check_name(conn, fname_src_dir);
6735         if (!NT_STATUS_IS_OK(status)) {
6736                 goto out;
6737         }
6738
6739         dir_hnd = OpenDir(talloc_tos(), conn, fname_src_dir, fname_src_mask,
6740                           attrs);
6741         if (dir_hnd == NULL) {
6742                 status = map_nt_error_from_unix(errno);
6743                 goto out;
6744         }
6745
6746         status = NT_STATUS_NO_SUCH_FILE;
6747         /*
6748          * Was status = NT_STATUS_OBJECT_NAME_NOT_FOUND;
6749          * - gentest fix. JRA
6750          */
6751
6752         while ((dname = ReadDirName(dir_hnd, &offset, &smb_fname_src->st,
6753                                     &talloced))) {
6754                 files_struct *fsp = NULL;
6755                 char *destname = NULL;
6756                 bool sysdir_entry = False;
6757
6758                 /* Quick check for "." and ".." */
6759                 if (ISDOT(dname) || ISDOTDOT(dname)) {
6760                         if (attrs & FILE_ATTRIBUTE_DIRECTORY) {
6761                                 sysdir_entry = True;
6762                         } else {
6763                                 TALLOC_FREE(talloced);
6764                                 continue;
6765                         }
6766                 }
6767
6768                 if (!is_visible_file(conn, fname_src_dir, dname,
6769                                      &smb_fname_src->st, false)) {
6770                         TALLOC_FREE(talloced);
6771                         continue;
6772                 }
6773
6774                 if(!mask_match(dname, fname_src_mask, conn->case_sensitive)) {
6775                         TALLOC_FREE(talloced);
6776                         continue;
6777                 }
6778
6779                 if (sysdir_entry) {
6780                         status = NT_STATUS_OBJECT_NAME_INVALID;
6781                         break;
6782                 }
6783
6784                 TALLOC_FREE(smb_fname_src->base_name);
6785                 if (ISDOT(fname_src_dir)) {
6786                         /* Ensure we use canonical names on open. */
6787                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6788                                                         "%s",
6789                                                         dname);
6790                 } else {
6791                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
6792                                                         "%s/%s",
6793                                                         fname_src_dir,
6794                                                         dname);
6795                 }
6796                 if (!smb_fname_src->base_name) {
6797                         status = NT_STATUS_NO_MEMORY;
6798                         goto out;
6799                 }
6800
6801                 if (!resolve_wildcards(ctx, smb_fname_src->base_name,
6802                                        smb_fname_dst->base_name,
6803                                        &destname)) {
6804                         DEBUG(6, ("resolve_wildcards %s %s failed\n",
6805                                   smb_fname_src->base_name, destname));
6806                         TALLOC_FREE(talloced);
6807                         continue;
6808                 }
6809                 if (!destname) {
6810                         status = NT_STATUS_NO_MEMORY;
6811                         goto out;
6812                 }
6813
6814                 TALLOC_FREE(smb_fname_dst->base_name);
6815                 smb_fname_dst->base_name = destname;
6816
6817                 ZERO_STRUCT(smb_fname_src->st);
6818                 if (posix_pathnames) {
6819                         SMB_VFS_LSTAT(conn, smb_fname_src);
6820                 } else {
6821                         SMB_VFS_STAT(conn, smb_fname_src);
6822                 }
6823
6824                 create_options = 0;
6825
6826                 if (S_ISDIR(smb_fname_src->st.st_ex_mode)) {
6827                         create_options |= FILE_DIRECTORY_FILE;
6828                 }
6829
6830                 status = SMB_VFS_CREATE_FILE(
6831                         conn,                           /* conn */
6832                         req,                            /* req */
6833                         0,                              /* root_dir_fid */
6834                         smb_fname_src,                  /* fname */
6835                         access_mask,                    /* access_mask */
6836                         (FILE_SHARE_READ |              /* share_access */
6837                             FILE_SHARE_WRITE),
6838                         FILE_OPEN,                      /* create_disposition*/
6839                         create_options,                 /* create_options */
6840                         posix_pathnames ? FILE_FLAG_POSIX_SEMANTICS|0777 : 0, /* file_attributes */
6841                         0,                              /* oplock_request */
6842                         0,                              /* allocation_size */
6843                         0,                              /* private_flags */
6844                         NULL,                           /* sd */
6845                         NULL,                           /* ea_list */
6846                         &fsp,                           /* result */
6847                         NULL);                          /* pinfo */
6848
6849                 if (!NT_STATUS_IS_OK(status)) {
6850                         DEBUG(3,("rename_internals: SMB_VFS_CREATE_FILE "
6851                                  "returned %s rename %s -> %s\n",
6852                                  nt_errstr(status),
6853                                  smb_fname_str_dbg(smb_fname_src),
6854                                  smb_fname_str_dbg(smb_fname_dst)));
6855                         break;
6856                 }
6857
6858                 smb_fname_dst->original_lcomp = talloc_strdup(smb_fname_dst,
6859                                                               dname);
6860                 if (!smb_fname_dst->original_lcomp) {
6861                         status = NT_STATUS_NO_MEMORY;
6862                         goto out;
6863                 }
6864
6865                 status = rename_internals_fsp(conn, fsp, smb_fname_dst,
6866                                               attrs, replace_if_exists);
6867
6868                 close_file(req, fsp, NORMAL_CLOSE);
6869
6870                 if (!NT_STATUS_IS_OK(status)) {
6871                         DEBUG(3, ("rename_internals_fsp returned %s for "
6872                                   "rename %s -> %s\n", nt_errstr(status),
6873                                   smb_fname_str_dbg(smb_fname_src),
6874                                   smb_fname_str_dbg(smb_fname_dst)));
6875                         break;
6876                 }
6877
6878                 count++;
6879
6880                 DEBUG(3,("rename_internals: doing rename on %s -> "
6881                          "%s\n", smb_fname_str_dbg(smb_fname_src),
6882                          smb_fname_str_dbg(smb_fname_src)));
6883                 TALLOC_FREE(talloced);
6884         }
6885         TALLOC_FREE(dir_hnd);
6886
6887         if (count == 0 && NT_STATUS_IS_OK(status) && errno != 0) {
6888                 status = map_nt_error_from_unix(errno);
6889         }
6890
6891  out:
6892         TALLOC_FREE(talloced);
6893         TALLOC_FREE(fname_src_dir);
6894         TALLOC_FREE(fname_src_mask);
6895         return status;
6896 }
6897
6898 /****************************************************************************
6899  Reply to a mv.
6900 ****************************************************************************/
6901
6902 void reply_mv(struct smb_request *req)
6903 {
6904         connection_struct *conn = req->conn;
6905         char *name = NULL;
6906         char *newname = NULL;
6907         const char *p;
6908         uint32 attrs;
6909         NTSTATUS status;
6910         bool src_has_wcard = False;
6911         bool dest_has_wcard = False;
6912         TALLOC_CTX *ctx = talloc_tos();
6913         struct smb_filename *smb_fname_src = NULL;
6914         struct smb_filename *smb_fname_dst = NULL;
6915         uint32_t src_ucf_flags = lp_posix_pathnames() ? UCF_UNIX_NAME_LOOKUP : UCF_COND_ALLOW_WCARD_LCOMP;
6916         uint32_t dst_ucf_flags = UCF_SAVE_LCOMP | (lp_posix_pathnames() ? 0 : UCF_COND_ALLOW_WCARD_LCOMP);
6917         bool stream_rename = false;
6918
6919         START_PROFILE(SMBmv);
6920
6921         if (req->wct < 1) {
6922                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6923                 goto out;
6924         }
6925
6926         attrs = SVAL(req->vwv+0, 0);
6927
6928         p = (const char *)req->buf + 1;
6929         p += srvstr_get_path_req_wcard(ctx, req, &name, p, STR_TERMINATE,
6930                                        &status, &src_has_wcard);
6931         if (!NT_STATUS_IS_OK(status)) {
6932                 reply_nterror(req, status);
6933                 goto out;
6934         }
6935         p++;
6936         p += srvstr_get_path_req_wcard(ctx, req, &newname, p, STR_TERMINATE,
6937                                        &status, &dest_has_wcard);
6938         if (!NT_STATUS_IS_OK(status)) {
6939                 reply_nterror(req, status);
6940                 goto out;
6941         }
6942
6943         if (!lp_posix_pathnames()) {
6944                 /* The newname must begin with a ':' if the
6945                    name contains a ':'. */
6946                 if (strchr_m(name, ':')) {
6947                         if (newname[0] != ':') {
6948                                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
6949                                 goto out;
6950                         }
6951                         stream_rename = true;
6952                 }
6953         }
6954
6955         status = filename_convert(ctx,
6956                                   conn,
6957                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6958                                   name,
6959                                   src_ucf_flags,
6960                                   &src_has_wcard,
6961                                   &smb_fname_src);
6962
6963         if (!NT_STATUS_IS_OK(status)) {
6964                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6965                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6966                                         ERRSRV, ERRbadpath);
6967                         goto out;
6968                 }
6969                 reply_nterror(req, status);
6970                 goto out;
6971         }
6972
6973         status = filename_convert(ctx,
6974                                   conn,
6975                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
6976                                   newname,
6977                                   dst_ucf_flags,
6978                                   &dest_has_wcard,
6979                                   &smb_fname_dst);
6980
6981         if (!NT_STATUS_IS_OK(status)) {
6982                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
6983                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
6984                                         ERRSRV, ERRbadpath);
6985                         goto out;
6986                 }
6987                 reply_nterror(req, status);
6988                 goto out;
6989         }
6990
6991         if (stream_rename) {
6992                 /* smb_fname_dst->base_name must be the same as
6993                    smb_fname_src->base_name. */
6994                 TALLOC_FREE(smb_fname_dst->base_name);
6995                 smb_fname_dst->base_name = talloc_strdup(smb_fname_dst,
6996                                                 smb_fname_src->base_name);
6997                 if (!smb_fname_dst->base_name) {
6998                         reply_nterror(req, NT_STATUS_NO_MEMORY);
6999                         goto out;
7000                 }
7001         }
7002
7003         DEBUG(3,("reply_mv : %s -> %s\n", smb_fname_str_dbg(smb_fname_src),
7004                  smb_fname_str_dbg(smb_fname_dst)));
7005
7006         status = rename_internals(ctx, conn, req, smb_fname_src, smb_fname_dst,
7007                                   attrs, False, src_has_wcard, dest_has_wcard,
7008                                   DELETE_ACCESS);
7009         if (!NT_STATUS_IS_OK(status)) {
7010                 if (open_was_deferred(req->sconn, req->mid)) {
7011                         /* We have re-scheduled this call. */
7012                         goto out;
7013                 }
7014                 reply_nterror(req, status);
7015                 goto out;
7016         }
7017
7018         reply_outbuf(req, 0, 0);
7019  out:
7020         TALLOC_FREE(smb_fname_src);
7021         TALLOC_FREE(smb_fname_dst);
7022         END_PROFILE(SMBmv);
7023         return;
7024 }
7025
7026 /*******************************************************************
7027  Copy a file as part of a reply_copy.
7028 ******************************************************************/
7029
7030 /*
7031  * TODO: check error codes on all callers
7032  */
7033
7034 NTSTATUS copy_file(TALLOC_CTX *ctx,
7035                         connection_struct *conn,
7036                         struct smb_filename *smb_fname_src,
7037                         struct smb_filename *smb_fname_dst,
7038                         int ofun,
7039                         int count,
7040                         bool target_is_directory)
7041 {
7042         struct smb_filename *smb_fname_dst_tmp = NULL;
7043         off_t ret=-1;
7044         files_struct *fsp1,*fsp2;
7045         uint32 dosattrs;
7046         uint32 new_create_disposition;
7047         NTSTATUS status;
7048
7049
7050         smb_fname_dst_tmp = cp_smb_filename(ctx, smb_fname_dst);
7051         if (smb_fname_dst_tmp == NULL) {
7052                 return NT_STATUS_NO_MEMORY;
7053         }
7054
7055         /*
7056          * If the target is a directory, extract the last component from the
7057          * src filename and append it to the dst filename
7058          */
7059         if (target_is_directory) {
7060                 const char *p;
7061
7062                 /* dest/target can't be a stream if it's a directory. */
7063                 SMB_ASSERT(smb_fname_dst->stream_name == NULL);
7064
7065                 p = strrchr_m(smb_fname_src->base_name,'/');
7066                 if (p) {
7067                         p++;
7068                 } else {
7069                         p = smb_fname_src->base_name;
7070                 }
7071                 smb_fname_dst_tmp->base_name =
7072                     talloc_asprintf_append(smb_fname_dst_tmp->base_name, "/%s",
7073                                            p);
7074                 if (!smb_fname_dst_tmp->base_name) {
7075                         status = NT_STATUS_NO_MEMORY;
7076                         goto out;
7077                 }
7078         }
7079
7080         status = vfs_file_exist(conn, smb_fname_src);
7081         if (!NT_STATUS_IS_OK(status)) {
7082                 goto out;
7083         }
7084
7085         if (!target_is_directory && count) {
7086                 new_create_disposition = FILE_OPEN;
7087         } else {
7088                 if (!map_open_params_to_ntcreate(smb_fname_dst_tmp->base_name,
7089                                                  0, ofun,
7090                                                  NULL, NULL,
7091                                                  &new_create_disposition,
7092                                                  NULL,
7093                                                  NULL)) {
7094                         status = NT_STATUS_INVALID_PARAMETER;
7095                         goto out;
7096                 }
7097         }
7098
7099         /* Open the src file for reading. */
7100         status = SMB_VFS_CREATE_FILE(
7101                 conn,                                   /* conn */
7102                 NULL,                                   /* req */
7103                 0,                                      /* root_dir_fid */
7104                 smb_fname_src,                          /* fname */
7105                 FILE_GENERIC_READ,                      /* access_mask */
7106                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7107                 FILE_OPEN,                              /* create_disposition*/
7108                 0,                                      /* create_options */
7109                 FILE_ATTRIBUTE_NORMAL,                  /* file_attributes */
7110                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7111                 0,                                      /* allocation_size */
7112                 0,                                      /* private_flags */
7113                 NULL,                                   /* sd */
7114                 NULL,                                   /* ea_list */
7115                 &fsp1,                                  /* result */
7116                 NULL);                                  /* psbuf */
7117
7118         if (!NT_STATUS_IS_OK(status)) {
7119                 goto out;
7120         }
7121
7122         dosattrs = dos_mode(conn, smb_fname_src);
7123
7124         if (SMB_VFS_STAT(conn, smb_fname_dst_tmp) == -1) {
7125                 ZERO_STRUCTP(&smb_fname_dst_tmp->st);
7126         }
7127
7128         /* Open the dst file for writing. */
7129         status = SMB_VFS_CREATE_FILE(
7130                 conn,                                   /* conn */
7131                 NULL,                                   /* req */
7132                 0,                                      /* root_dir_fid */
7133                 smb_fname_dst,                          /* fname */
7134                 FILE_GENERIC_WRITE,                     /* access_mask */
7135                 FILE_SHARE_READ | FILE_SHARE_WRITE,     /* share_access */
7136                 new_create_disposition,                 /* create_disposition*/
7137                 0,                                      /* create_options */
7138                 dosattrs,                               /* file_attributes */
7139                 INTERNAL_OPEN_ONLY,                     /* oplock_request */
7140                 0,                                      /* allocation_size */
7141                 0,                                      /* private_flags */
7142                 NULL,                                   /* sd */
7143                 NULL,                                   /* ea_list */
7144                 &fsp2,                                  /* result */
7145                 NULL);                                  /* psbuf */
7146
7147         if (!NT_STATUS_IS_OK(status)) {
7148                 close_file(NULL, fsp1, ERROR_CLOSE);
7149                 goto out;
7150         }
7151
7152         if (ofun & OPENX_FILE_EXISTS_OPEN) {
7153                 ret = SMB_VFS_LSEEK(fsp2, 0, SEEK_END);
7154                 if (ret == -1) {
7155                         DEBUG(0, ("error - vfs lseek returned error %s\n",
7156                                 strerror(errno)));
7157                         status = map_nt_error_from_unix(errno);
7158                         close_file(NULL, fsp1, ERROR_CLOSE);
7159                         close_file(NULL, fsp2, ERROR_CLOSE);
7160                         goto out;
7161                 }
7162         }
7163
7164         /* Do the actual copy. */
7165         if (smb_fname_src->st.st_ex_size) {
7166                 ret = vfs_transfer_file(fsp1, fsp2, smb_fname_src->st.st_ex_size);
7167         } else {
7168                 ret = 0;
7169         }
7170
7171         close_file(NULL, fsp1, NORMAL_CLOSE);
7172
7173         /* Ensure the modtime is set correctly on the destination file. */
7174         set_close_write_time(fsp2, smb_fname_src->st.st_ex_mtime);
7175
7176         /*
7177          * As we are opening fsp1 read-only we only expect
7178          * an error on close on fsp2 if we are out of space.
7179          * Thus we don't look at the error return from the
7180          * close of fsp1.
7181          */
7182         status = close_file(NULL, fsp2, NORMAL_CLOSE);
7183
7184         if (!NT_STATUS_IS_OK(status)) {
7185                 goto out;
7186         }
7187
7188         if (ret != (off_t)smb_fname_src->st.st_ex_size) {
7189                 status = NT_STATUS_DISK_FULL;
7190                 goto out;
7191         }
7192
7193         status = NT_STATUS_OK;
7194
7195  out:
7196         TALLOC_FREE(smb_fname_dst_tmp);
7197         return status;
7198 }
7199
7200 /****************************************************************************
7201  Reply to a file copy.
7202 ****************************************************************************/
7203
7204 void reply_copy(struct smb_request *req)
7205 {
7206         connection_struct *conn = req->conn;
7207         struct smb_filename *smb_fname_src = NULL;
7208         struct smb_filename *smb_fname_dst = NULL;
7209         char *fname_src = NULL;
7210         char *fname_dst = NULL;
7211         char *fname_src_mask = NULL;
7212         char *fname_src_dir = NULL;
7213         const char *p;
7214         int count=0;
7215         int error = ERRnoaccess;
7216         int tid2;
7217         int ofun;
7218         int flags;
7219         bool target_is_directory=False;
7220         bool source_has_wild = False;
7221         bool dest_has_wild = False;
7222         NTSTATUS status;
7223         TALLOC_CTX *ctx = talloc_tos();
7224
7225         START_PROFILE(SMBcopy);
7226
7227         if (req->wct < 3) {
7228                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7229                 goto out;
7230         }
7231
7232         tid2 = SVAL(req->vwv+0, 0);
7233         ofun = SVAL(req->vwv+1, 0);
7234         flags = SVAL(req->vwv+2, 0);
7235
7236         p = (const char *)req->buf;
7237         p += srvstr_get_path_req_wcard(ctx, req, &fname_src, p, STR_TERMINATE,
7238                                        &status, &source_has_wild);
7239         if (!NT_STATUS_IS_OK(status)) {
7240                 reply_nterror(req, status);
7241                 goto out;
7242         }
7243         p += srvstr_get_path_req_wcard(ctx, req, &fname_dst, p, STR_TERMINATE,
7244                                        &status, &dest_has_wild);
7245         if (!NT_STATUS_IS_OK(status)) {
7246                 reply_nterror(req, status);
7247                 goto out;
7248         }
7249
7250         DEBUG(3,("reply_copy : %s -> %s\n", fname_src, fname_dst));
7251
7252         if (tid2 != conn->cnum) {
7253                 /* can't currently handle inter share copies XXXX */
7254                 DEBUG(3,("Rejecting inter-share copy\n"));
7255                 reply_nterror(req, NT_STATUS_BAD_DEVICE_TYPE);
7256                 goto out;
7257         }
7258
7259         status = filename_convert(ctx, conn,
7260                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7261                                   fname_src,
7262                                   UCF_COND_ALLOW_WCARD_LCOMP,
7263                                   &source_has_wild,
7264                                   &smb_fname_src);
7265         if (!NT_STATUS_IS_OK(status)) {
7266                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7267                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7268                                         ERRSRV, ERRbadpath);
7269                         goto out;
7270                 }
7271                 reply_nterror(req, status);
7272                 goto out;
7273         }
7274
7275         status = filename_convert(ctx, conn,
7276                                   req->flags2 & FLAGS2_DFS_PATHNAMES,
7277                                   fname_dst,
7278                                   UCF_COND_ALLOW_WCARD_LCOMP,
7279                                   &dest_has_wild,
7280                                   &smb_fname_dst);
7281         if (!NT_STATUS_IS_OK(status)) {
7282                 if (NT_STATUS_EQUAL(status,NT_STATUS_PATH_NOT_COVERED)) {
7283                         reply_botherror(req, NT_STATUS_PATH_NOT_COVERED,
7284                                         ERRSRV, ERRbadpath);
7285                         goto out;
7286                 }
7287                 reply_nterror(req, status);
7288                 goto out;
7289         }
7290
7291         target_is_directory = VALID_STAT_OF_DIR(smb_fname_dst->st);
7292
7293         if ((flags&1) && target_is_directory) {
7294                 reply_nterror(req, NT_STATUS_NO_SUCH_FILE);
7295                 goto out;
7296         }
7297
7298         if ((flags&2) && !target_is_directory) {
7299                 reply_nterror(req, NT_STATUS_OBJECT_PATH_NOT_FOUND);
7300                 goto out;
7301         }
7302
7303         if ((flags&(1<<5)) && VALID_STAT_OF_DIR(smb_fname_src->st)) {
7304                 /* wants a tree copy! XXXX */
7305                 DEBUG(3,("Rejecting tree copy\n"));
7306                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7307                 goto out;
7308         }
7309
7310         /* Split up the directory from the filename/mask. */
7311         status = split_fname_dir_mask(ctx, smb_fname_src->base_name,
7312                                       &fname_src_dir, &fname_src_mask);
7313         if (!NT_STATUS_IS_OK(status)) {
7314                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7315                 goto out;
7316         }
7317
7318         /*
7319          * We should only check the mangled cache
7320          * here if unix_convert failed. This means
7321          * that the path in 'mask' doesn't exist
7322          * on the file system and so we need to look
7323          * for a possible mangle. This patch from
7324          * Tine Smukavec <valentin.smukavec@hermes.si>.
7325          */
7326         if (!VALID_STAT(smb_fname_src->st) &&
7327             mangle_is_mangled(fname_src_mask, conn->params)) {
7328                 char *new_mask = NULL;
7329                 mangle_lookup_name_from_8_3(ctx, fname_src_mask,
7330                                             &new_mask, conn->params);
7331
7332                 /* Use demangled name if one was successfully found. */
7333                 if (new_mask) {
7334                         TALLOC_FREE(fname_src_mask);
7335                         fname_src_mask = new_mask;
7336                 }
7337         }
7338
7339         if (!source_has_wild) {
7340
7341                 /*
7342                  * Only one file needs to be copied. Append the mask back onto
7343                  * the directory.
7344                  */
7345                 TALLOC_FREE(smb_fname_src->base_name);
7346                 if (ISDOT(fname_src_dir)) {
7347                         /* Ensure we use canonical names on open. */
7348                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7349                                                         "%s",
7350                                                         fname_src_mask);
7351                 } else {
7352                         smb_fname_src->base_name = talloc_asprintf(smb_fname_src,
7353                                                         "%s/%s",
7354                                                         fname_src_dir,
7355                                                         fname_src_mask);
7356                 }
7357                 if (!smb_fname_src->base_name) {
7358                         reply_nterror(req, NT_STATUS_NO_MEMORY);
7359                         goto out;
7360                 }
7361
7362                 if (dest_has_wild) {
7363                         char *fname_dst_mod = NULL;
7364                         if (!resolve_wildcards(smb_fname_dst,
7365                                                smb_fname_src->base_name,
7366                                                smb_fname_dst->base_name,
7367                                                &fname_dst_mod)) {
7368                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7369                                 goto out;
7370                         }
7371                         TALLOC_FREE(smb_fname_dst->base_name);
7372                         smb_fname_dst->base_name = fname_dst_mod;
7373                 }
7374
7375                 status = check_name(conn, smb_fname_src->base_name);
7376                 if (!NT_STATUS_IS_OK(status)) {
7377                         reply_nterror(req, status);
7378                         goto out;
7379                 }
7380
7381                 status = check_name(conn, smb_fname_dst->base_name);
7382                 if (!NT_STATUS_IS_OK(status)) {
7383                         reply_nterror(req, status);
7384                         goto out;
7385                 }
7386
7387                 status = copy_file(ctx, conn, smb_fname_src, smb_fname_dst,
7388                                    ofun, count, target_is_directory);
7389
7390                 if(!NT_STATUS_IS_OK(status)) {
7391                         reply_nterror(req, status);
7392                         goto out;
7393                 } else {
7394                         count++;
7395                 }
7396         } else {
7397                 struct smb_Dir *dir_hnd = NULL;
7398                 const char *dname = NULL;
7399                 char *talloced = NULL;
7400                 long offset = 0;
7401
7402                 /*
7403                  * There is a wildcard that requires us to actually read the
7404                  * src dir and copy each file matching the mask to the dst.
7405                  * Right now streams won't be copied, but this could
7406                  * presumably be added with a nested loop for reach dir entry.
7407                  */
7408                 SMB_ASSERT(!smb_fname_src->stream_name);
7409                 SMB_ASSERT(!smb_fname_dst->stream_name);
7410
7411                 smb_fname_src->stream_name = NULL;
7412                 smb_fname_dst->stream_name = NULL;
7413
7414                 if (strequal(fname_src_mask,"????????.???")) {
7415                         TALLOC_FREE(fname_src_mask);
7416                         fname_src_mask = talloc_strdup(ctx, "*");
7417                         if (!fname_src_mask) {
7418                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7419                                 goto out;
7420                         }
7421                 }
7422
7423                 status = check_name(conn, fname_src_dir);
7424                 if (!NT_STATUS_IS_OK(status)) {
7425                         reply_nterror(req, status);
7426                         goto out;
7427                 }
7428
7429                 dir_hnd = OpenDir(ctx, conn, fname_src_dir, fname_src_mask, 0);
7430                 if (dir_hnd == NULL) {
7431                         status = map_nt_error_from_unix(errno);
7432                         reply_nterror(req, status);
7433                         goto out;
7434                 }
7435
7436                 error = ERRbadfile;
7437
7438                 /* Iterate over the src dir copying each entry to the dst. */
7439                 while ((dname = ReadDirName(dir_hnd, &offset,
7440                                             &smb_fname_src->st, &talloced))) {
7441                         char *destname = NULL;
7442
7443                         if (ISDOT(dname) || ISDOTDOT(dname)) {
7444                                 TALLOC_FREE(talloced);
7445                                 continue;
7446                         }
7447
7448                         if (!is_visible_file(conn, fname_src_dir, dname,
7449                                              &smb_fname_src->st, false)) {
7450                                 TALLOC_FREE(talloced);
7451                                 continue;
7452                         }
7453
7454                         if(!mask_match(dname, fname_src_mask,
7455                                        conn->case_sensitive)) {
7456                                 TALLOC_FREE(talloced);
7457                                 continue;
7458                         }
7459
7460                         error = ERRnoaccess;
7461
7462                         /* Get the src smb_fname struct setup. */
7463                         TALLOC_FREE(smb_fname_src->base_name);
7464                         if (ISDOT(fname_src_dir)) {
7465                                 /* Ensure we use canonical names on open. */
7466                                 smb_fname_src->base_name =
7467                                         talloc_asprintf(smb_fname_src, "%s",
7468                                                 dname);
7469                         } else {
7470                                 smb_fname_src->base_name =
7471                                         talloc_asprintf(smb_fname_src, "%s/%s",
7472                                                 fname_src_dir, dname);
7473                         }
7474
7475                         if (!smb_fname_src->base_name) {
7476                                 TALLOC_FREE(dir_hnd);
7477                                 TALLOC_FREE(talloced);
7478                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7479                                 goto out;
7480                         }
7481
7482                         if (!resolve_wildcards(ctx, smb_fname_src->base_name,
7483                                                smb_fname_dst->base_name,
7484                                                &destname)) {
7485                                 TALLOC_FREE(talloced);
7486                                 continue;
7487                         }
7488                         if (!destname) {
7489                                 TALLOC_FREE(dir_hnd);
7490                                 TALLOC_FREE(talloced);
7491                                 reply_nterror(req, NT_STATUS_NO_MEMORY);
7492                                 goto out;
7493                         }
7494
7495                         TALLOC_FREE(smb_fname_dst->base_name);
7496                         smb_fname_dst->base_name = destname;
7497
7498                         status = check_name(conn, smb_fname_src->base_name);
7499                         if (!NT_STATUS_IS_OK(status)) {
7500                                 TALLOC_FREE(dir_hnd);
7501                                 TALLOC_FREE(talloced);
7502                                 reply_nterror(req, status);
7503                                 goto out;
7504                         }
7505
7506                         status = check_name(conn, smb_fname_dst->base_name);
7507                         if (!NT_STATUS_IS_OK(status)) {
7508                                 TALLOC_FREE(dir_hnd);
7509                                 TALLOC_FREE(talloced);
7510                                 reply_nterror(req, status);
7511                                 goto out;
7512                         }
7513
7514                         DEBUG(3,("reply_copy : doing copy on %s -> %s\n",
7515                                 smb_fname_src->base_name,
7516                                 smb_fname_dst->base_name));
7517
7518                         status = copy_file(ctx, conn, smb_fname_src,
7519                                            smb_fname_dst, ofun, count,
7520                                            target_is_directory);
7521                         if (NT_STATUS_IS_OK(status)) {
7522                                 count++;
7523                         }
7524
7525                         TALLOC_FREE(talloced);
7526                 }
7527                 TALLOC_FREE(dir_hnd);
7528         }
7529
7530         if (count == 0) {
7531                 reply_nterror(req, dos_to_ntstatus(ERRDOS, error));
7532                 goto out;
7533         }
7534
7535         reply_outbuf(req, 1, 0);
7536         SSVAL(req->outbuf,smb_vwv0,count);
7537  out:
7538         TALLOC_FREE(smb_fname_src);
7539         TALLOC_FREE(smb_fname_dst);
7540         TALLOC_FREE(fname_src);
7541         TALLOC_FREE(fname_dst);
7542         TALLOC_FREE(fname_src_mask);
7543         TALLOC_FREE(fname_src_dir);
7544
7545         END_PROFILE(SMBcopy);
7546         return;
7547 }
7548
7549 #undef DBGC_CLASS
7550 #define DBGC_CLASS DBGC_LOCKING
7551
7552 /****************************************************************************
7553  Get a lock pid, dealing with large count requests.
7554 ****************************************************************************/
7555
7556 uint64_t get_lock_pid(const uint8_t *data, int data_offset,
7557                     bool large_file_format)
7558 {
7559         if(!large_file_format)
7560                 return (uint64_t)SVAL(data,SMB_LPID_OFFSET(data_offset));
7561         else
7562                 return (uint64_t)SVAL(data,SMB_LARGE_LPID_OFFSET(data_offset));
7563 }
7564
7565 /****************************************************************************
7566  Get a lock count, dealing with large count requests.
7567 ****************************************************************************/
7568
7569 uint64_t get_lock_count(const uint8_t *data, int data_offset,
7570                         bool large_file_format)
7571 {
7572         uint64_t count = 0;
7573
7574         if(!large_file_format) {
7575                 count = (uint64_t)IVAL(data,SMB_LKLEN_OFFSET(data_offset));
7576         } else {
7577
7578 #if defined(HAVE_LONGLONG)
7579                 count = (((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset))) << 32) |
7580                         ((uint64_t) IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)));
7581 #else /* HAVE_LONGLONG */
7582
7583                 /*
7584                  * NT4.x seems to be broken in that it sends large file (64 bit)
7585                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7586                  * negotiated. For boxes without large unsigned ints truncate the
7587                  * lock count by dropping the top 32 bits.
7588                  */
7589
7590                 if(IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)) != 0) {
7591                         DEBUG(3,("get_lock_count: truncating lock count (high)0x%x (low)0x%x to just low count.\n",
7592                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset)),
7593                                 (unsigned int)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset)) ));
7594                                 SIVAL(data,SMB_LARGE_LKLEN_OFFSET_HIGH(data_offset),0);
7595                 }
7596
7597                 count = (uint64_t)IVAL(data,SMB_LARGE_LKLEN_OFFSET_LOW(data_offset));
7598 #endif /* HAVE_LONGLONG */
7599         }
7600
7601         return count;
7602 }
7603
7604 #if !defined(HAVE_LONGLONG)
7605 /****************************************************************************
7606  Pathetically try and map a 64 bit lock offset into 31 bits. I hate Windows :-).
7607 ****************************************************************************/
7608
7609 static uint32 map_lock_offset(uint32 high, uint32 low)
7610 {
7611         unsigned int i;
7612         uint32 mask = 0;
7613         uint32 highcopy = high;
7614
7615         /*
7616          * Try and find out how many significant bits there are in high.
7617          */
7618
7619         for(i = 0; highcopy; i++)
7620                 highcopy >>= 1;
7621
7622         /*
7623          * We use 31 bits not 32 here as POSIX
7624          * lock offsets may not be negative.
7625          */
7626
7627         mask = (~0) << (31 - i);
7628
7629         if(low & mask)
7630                 return 0; /* Fail. */
7631
7632         high <<= (31 - i);
7633
7634         return (high|low);
7635 }
7636 #endif /* !defined(HAVE_LONGLONG) */
7637
7638 /****************************************************************************
7639  Get a lock offset, dealing with large offset requests.
7640 ****************************************************************************/
7641
7642 uint64_t get_lock_offset(const uint8_t *data, int data_offset,
7643                          bool large_file_format, bool *err)
7644 {
7645         uint64_t offset = 0;
7646
7647         *err = False;
7648
7649         if(!large_file_format) {
7650                 offset = (uint64_t)IVAL(data,SMB_LKOFF_OFFSET(data_offset));
7651         } else {
7652
7653 #if defined(HAVE_LONGLONG)
7654                 offset = (((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset))) << 32) |
7655                                 ((uint64_t) IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset)));
7656 #else /* HAVE_LONGLONG */
7657
7658                 /*
7659                  * NT4.x seems to be broken in that it sends large file (64 bit)
7660                  * lockingX calls even if the CAP_LARGE_FILES was *not*
7661                  * negotiated. For boxes without large unsigned ints mangle the
7662                  * lock offset by mapping the top 32 bits onto the lower 32.
7663                  */
7664
7665                 if(IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset)) != 0) {
7666                         uint32 low = IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7667                         uint32 high = IVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset));
7668                         uint32 new_low = 0;
7669
7670                         if((new_low = map_lock_offset(high, low)) == 0) {
7671                                 *err = True;
7672                                 return (uint64_t)-1;
7673                         }
7674
7675                         DEBUG(3,("get_lock_offset: truncating lock offset (high)0x%x (low)0x%x to offset 0x%x.\n",
7676                                 (unsigned int)high, (unsigned int)low, (unsigned int)new_low ));
7677                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_HIGH(data_offset),0);
7678                         SIVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset),new_low);
7679                 }
7680
7681                 offset = (uint64_t)IVAL(data,SMB_LARGE_LKOFF_OFFSET_LOW(data_offset));
7682 #endif /* HAVE_LONGLONG */
7683         }
7684
7685         return offset;
7686 }
7687
7688 NTSTATUS smbd_do_locking(struct smb_request *req,
7689                          files_struct *fsp,
7690                          uint8_t type,
7691                          int32_t timeout,
7692                          uint16_t num_ulocks,
7693                          struct smbd_lock_element *ulocks,
7694                          uint16_t num_locks,
7695                          struct smbd_lock_element *locks,
7696                          bool *async)
7697 {
7698         connection_struct *conn = req->conn;
7699         int i;
7700         NTSTATUS status = NT_STATUS_OK;
7701
7702         *async = false;
7703
7704         /* Data now points at the beginning of the list
7705            of smb_unlkrng structs */
7706         for(i = 0; i < (int)num_ulocks; i++) {
7707                 struct smbd_lock_element *e = &ulocks[i];
7708
7709                 DEBUG(10,("smbd_do_locking: unlock start=%.0f, len=%.0f for "
7710                           "pid %u, file %s\n",
7711                           (double)e->offset,
7712                           (double)e->count,
7713                           (unsigned int)e->smblctx,
7714                           fsp_str_dbg(fsp)));
7715
7716                 if (e->brltype != UNLOCK_LOCK) {
7717                         /* this can only happen with SMB2 */
7718                         return NT_STATUS_INVALID_PARAMETER;
7719                 }
7720
7721                 status = do_unlock(req->sconn->msg_ctx,
7722                                 fsp,
7723                                 e->smblctx,
7724                                 e->count,
7725                                 e->offset,
7726                                 WINDOWS_LOCK);
7727
7728                 DEBUG(10, ("smbd_do_locking: unlock returned %s\n",
7729                     nt_errstr(status)));
7730
7731                 if (!NT_STATUS_IS_OK(status)) {
7732                         return status;
7733                 }
7734         }
7735
7736         /* Setup the timeout in seconds. */
7737
7738         if (!lp_blocking_locks(SNUM(conn))) {
7739                 timeout = 0;
7740         }
7741
7742         /* Data now points at the beginning of the list
7743            of smb_lkrng structs */
7744
7745         for(i = 0; i < (int)num_locks; i++) {
7746                 struct smbd_lock_element *e = &locks[i];
7747
7748                 DEBUG(10,("smbd_do_locking: lock start=%.0f, len=%.0f for smblctx "
7749                           "%llu, file %s timeout = %d\n",
7750                           (double)e->offset,
7751                           (double)e->count,
7752                           (unsigned long long)e->smblctx,
7753                           fsp_str_dbg(fsp),
7754                           (int)timeout));
7755
7756                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7757                         struct blocking_lock_record *blr = NULL;
7758
7759                         if (num_locks > 1) {
7760                                 /*
7761                                  * MS-CIFS (2.2.4.32.1) states that a cancel is honored if and only
7762                                  * if the lock vector contains one entry. When given mutliple cancel
7763                                  * requests in a single PDU we expect the server to return an
7764                                  * error. Windows servers seem to accept the request but only
7765                                  * cancel the first lock.
7766                                  * JRA - Do what Windows does (tm) :-).
7767                                  */
7768
7769 #if 0
7770                                 /* MS-CIFS (2.2.4.32.1) behavior. */
7771                                 return NT_STATUS_DOS(ERRDOS,
7772                                                 ERRcancelviolation);
7773 #else
7774                                 /* Windows behavior. */
7775                                 if (i != 0) {
7776                                         DEBUG(10,("smbd_do_locking: ignoring subsequent "
7777                                                 "cancel request\n"));
7778                                         continue;
7779                                 }
7780 #endif
7781                         }
7782
7783                         if (lp_blocking_locks(SNUM(conn))) {
7784
7785                                 /* Schedule a message to ourselves to
7786                                    remove the blocking lock record and
7787                                    return the right error. */
7788
7789                                 blr = blocking_lock_cancel_smb1(fsp,
7790                                                 e->smblctx,
7791                                                 e->offset,
7792                                                 e->count,
7793                                                 WINDOWS_LOCK,
7794                                                 type,
7795                                                 NT_STATUS_FILE_LOCK_CONFLICT);
7796                                 if (blr == NULL) {
7797                                         return NT_STATUS_DOS(
7798                                                         ERRDOS,
7799                                                         ERRcancelviolation);
7800                                 }
7801                         }
7802                         /* Remove a matching pending lock. */
7803                         status = do_lock_cancel(fsp,
7804                                                 e->smblctx,
7805                                                 e->count,
7806                                                 e->offset,
7807                                                 WINDOWS_LOCK,
7808                                                 blr);
7809                 } else {
7810                         bool blocking_lock = timeout ? true : false;
7811                         bool defer_lock = false;
7812                         struct byte_range_lock *br_lck;
7813                         uint64_t block_smblctx;
7814
7815                         br_lck = do_lock(req->sconn->msg_ctx,
7816                                         fsp,
7817                                         e->smblctx,
7818                                         e->count,
7819                                         e->offset,
7820                                         e->brltype,
7821                                         WINDOWS_LOCK,
7822                                         blocking_lock,
7823                                         &status,
7824                                         &block_smblctx,
7825                                         NULL);
7826
7827                         if (br_lck && blocking_lock && ERROR_WAS_LOCK_DENIED(status)) {
7828                                 /* Windows internal resolution for blocking locks seems
7829                                    to be about 200ms... Don't wait for less than that. JRA. */
7830                                 if (timeout != -1 && timeout < lp_lock_spin_time()) {
7831                                         timeout = lp_lock_spin_time();
7832                                 }
7833                                 defer_lock = true;
7834                         }
7835
7836                         /* If a lock sent with timeout of zero would fail, and
7837                          * this lock has been requested multiple times,
7838                          * according to brl_lock_failed() we convert this
7839                          * request to a blocking lock with a timeout of between
7840                          * 150 - 300 milliseconds.
7841                          *
7842                          * If lp_lock_spin_time() has been set to 0, we skip
7843                          * this blocking retry and fail immediately.
7844                          *
7845                          * Replacement for do_lock_spin(). JRA. */
7846
7847                         if (!req->sconn->using_smb2 &&
7848                             br_lck && lp_blocking_locks(SNUM(conn)) &&
7849                             lp_lock_spin_time() && !blocking_lock &&
7850                             NT_STATUS_EQUAL((status),
7851                                 NT_STATUS_FILE_LOCK_CONFLICT))
7852                         {
7853                                 defer_lock = true;
7854                                 timeout = lp_lock_spin_time();
7855                         }
7856
7857                         if (br_lck && defer_lock) {
7858                                 /*
7859                                  * A blocking lock was requested. Package up
7860                                  * this smb into a queued request and push it
7861                                  * onto the blocking lock queue.
7862                                  */
7863                                 if(push_blocking_lock_request(br_lck,
7864                                                         req,
7865                                                         fsp,
7866                                                         timeout,
7867                                                         i,
7868                                                         e->smblctx,
7869                                                         e->brltype,
7870                                                         WINDOWS_LOCK,
7871                                                         e->offset,
7872                                                         e->count,
7873                                                         block_smblctx)) {
7874                                         TALLOC_FREE(br_lck);
7875                                         *async = true;
7876                                         return NT_STATUS_OK;
7877                                 }
7878                         }
7879
7880                         TALLOC_FREE(br_lck);
7881                 }
7882
7883                 if (!NT_STATUS_IS_OK(status)) {
7884                         break;
7885                 }
7886         }
7887
7888         /* If any of the above locks failed, then we must unlock
7889            all of the previous locks (X/Open spec). */
7890
7891         if (num_locks != 0 && !NT_STATUS_IS_OK(status)) {
7892
7893                 if (type & LOCKING_ANDX_CANCEL_LOCK) {
7894                         i = -1; /* we want to skip the for loop */
7895                 }
7896
7897                 /*
7898                  * Ensure we don't do a remove on the lock that just failed,
7899                  * as under POSIX rules, if we have a lock already there, we
7900                  * will delete it (and we shouldn't) .....
7901                  */
7902                 for(i--; i >= 0; i--) {
7903                         struct smbd_lock_element *e = &locks[i];
7904
7905                         do_unlock(req->sconn->msg_ctx,
7906                                 fsp,
7907                                 e->smblctx,
7908                                 e->count,
7909                                 e->offset,
7910                                 WINDOWS_LOCK);
7911                 }
7912                 return status;
7913         }
7914
7915         DEBUG(3, ("smbd_do_locking: %s type=%d num_locks=%d num_ulocks=%d\n",
7916                   fsp_fnum_dbg(fsp), (unsigned int)type, num_locks, num_ulocks));
7917
7918         return NT_STATUS_OK;
7919 }
7920
7921 /****************************************************************************
7922  Reply to a lockingX request.
7923 ****************************************************************************/
7924
7925 void reply_lockingX(struct smb_request *req)
7926 {
7927         connection_struct *conn = req->conn;
7928         files_struct *fsp;
7929         unsigned char locktype;
7930         unsigned char oplocklevel;
7931         uint16 num_ulocks;
7932         uint16 num_locks;
7933         int32 lock_timeout;
7934         int i;
7935         const uint8_t *data;
7936         bool large_file_format;
7937         bool err;
7938         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
7939         struct smbd_lock_element *ulocks;
7940         struct smbd_lock_element *locks;
7941         bool async = false;
7942
7943         START_PROFILE(SMBlockingX);
7944
7945         if (req->wct < 8) {
7946                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
7947                 END_PROFILE(SMBlockingX);
7948                 return;
7949         }
7950
7951         fsp = file_fsp(req, SVAL(req->vwv+2, 0));
7952         locktype = CVAL(req->vwv+3, 0);
7953         oplocklevel = CVAL(req->vwv+3, 1);
7954         num_ulocks = SVAL(req->vwv+6, 0);
7955         num_locks = SVAL(req->vwv+7, 0);
7956         lock_timeout = IVAL(req->vwv+4, 0);
7957         large_file_format = (locktype & LOCKING_ANDX_LARGE_FILES)?True:False;
7958
7959         if (!check_fsp(conn, req, fsp)) {
7960                 END_PROFILE(SMBlockingX);
7961                 return;
7962         }
7963
7964         data = req->buf;
7965
7966         if (locktype & LOCKING_ANDX_CHANGE_LOCKTYPE) {
7967                 /* we don't support these - and CANCEL_LOCK makes w2k
7968                    and XP reboot so I don't really want to be
7969                    compatible! (tridge) */
7970                 reply_force_doserror(req, ERRDOS, ERRnoatomiclocks);
7971                 END_PROFILE(SMBlockingX);
7972                 return;
7973         }
7974
7975         /* Check if this is an oplock break on a file
7976            we have granted an oplock on.
7977         */
7978         if ((locktype & LOCKING_ANDX_OPLOCK_RELEASE)) {
7979                 /* Client can insist on breaking to none. */
7980                 bool break_to_none = (oplocklevel == 0);
7981                 bool result;
7982
7983                 DEBUG(5,("reply_lockingX: oplock break reply (%u) from client "
7984                          "for %s\n", (unsigned int)oplocklevel,
7985                          fsp_fnum_dbg(fsp)));
7986
7987                 /*
7988                  * Make sure we have granted an exclusive or batch oplock on
7989                  * this file.
7990                  */
7991
7992                 if (fsp->oplock_type == 0) {
7993
7994                         /* The Samba4 nbench simulator doesn't understand
7995                            the difference between break to level2 and break
7996                            to none from level2 - it sends oplock break
7997                            replies in both cases. Don't keep logging an error
7998                            message here - just ignore it. JRA. */
7999
8000                         DEBUG(5,("reply_lockingX: Error : oplock break from "
8001                                  "client for %s (oplock=%d) and no "
8002                                  "oplock granted on this file (%s).\n",
8003                                  fsp_fnum_dbg(fsp), fsp->oplock_type,
8004                                  fsp_str_dbg(fsp)));
8005
8006                         /* if this is a pure oplock break request then don't
8007                          * send a reply */
8008                         if (num_locks == 0 && num_ulocks == 0) {
8009                                 END_PROFILE(SMBlockingX);
8010                                 return;
8011                         } else {
8012                                 END_PROFILE(SMBlockingX);
8013                                 reply_nterror(req, NT_STATUS_FILE_LOCK_CONFLICT);
8014                                 return;
8015                         }
8016                 }
8017
8018                 if ((fsp->sent_oplock_break == BREAK_TO_NONE_SENT) ||
8019                     (break_to_none)) {
8020                         result = remove_oplock(fsp);
8021                 } else {
8022                         result = downgrade_oplock(fsp);
8023                 }
8024
8025                 if (!result) {
8026                         DEBUG(0, ("reply_lockingX: error in removing "
8027                                   "oplock on file %s\n", fsp_str_dbg(fsp)));
8028                         /* Hmmm. Is this panic justified? */
8029                         smb_panic("internal tdb error");
8030                 }
8031
8032                 /* if this is a pure oplock break request then don't send a
8033                  * reply */
8034                 if (num_locks == 0 && num_ulocks == 0) {
8035                         /* Sanity check - ensure a pure oplock break is not a
8036                            chained request. */
8037                         if(CVAL(req->vwv+0, 0) != 0xff)
8038                                 DEBUG(0,("reply_lockingX: Error : pure oplock "
8039                                          "break is a chained %d request !\n",
8040                                          (unsigned int)CVAL(req->vwv+0, 0)));
8041                         END_PROFILE(SMBlockingX);
8042                         return;
8043                 }
8044         }
8045
8046         if (req->buflen <
8047             (num_ulocks + num_locks) * (large_file_format ? 20 : 10)) {
8048                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8049                 END_PROFILE(SMBlockingX);
8050                 return;
8051         }
8052
8053         ulocks = talloc_array(req, struct smbd_lock_element, num_ulocks);
8054         if (ulocks == NULL) {
8055                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8056                 END_PROFILE(SMBlockingX);
8057                 return;
8058         }
8059
8060         locks = talloc_array(req, struct smbd_lock_element, num_locks);
8061         if (locks == NULL) {
8062                 reply_nterror(req, NT_STATUS_NO_MEMORY);
8063                 END_PROFILE(SMBlockingX);
8064                 return;
8065         }
8066
8067         /* Data now points at the beginning of the list
8068            of smb_unlkrng structs */
8069         for(i = 0; i < (int)num_ulocks; i++) {
8070                 ulocks[i].smblctx = get_lock_pid(data, i, large_file_format);
8071                 ulocks[i].count = get_lock_count(data, i, large_file_format);
8072                 ulocks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8073                 ulocks[i].brltype = UNLOCK_LOCK;
8074
8075                 /*
8076                  * There is no error code marked "stupid client bug".... :-).
8077                  */
8078                 if(err) {
8079                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8080                         END_PROFILE(SMBlockingX);
8081                         return;
8082                 }
8083         }
8084
8085         /* Now do any requested locks */
8086         data += ((large_file_format ? 20 : 10)*num_ulocks);
8087
8088         /* Data now points at the beginning of the list
8089            of smb_lkrng structs */
8090
8091         for(i = 0; i < (int)num_locks; i++) {
8092                 locks[i].smblctx = get_lock_pid(data, i, large_file_format);
8093                 locks[i].count = get_lock_count(data, i, large_file_format);
8094                 locks[i].offset = get_lock_offset(data, i, large_file_format, &err);
8095
8096                 if (locktype & LOCKING_ANDX_SHARED_LOCK) {
8097                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8098                                 locks[i].brltype = PENDING_READ_LOCK;
8099                         } else {
8100                                 locks[i].brltype = READ_LOCK;
8101                         }
8102                 } else {
8103                         if (locktype & LOCKING_ANDX_CANCEL_LOCK) {
8104                                 locks[i].brltype = PENDING_WRITE_LOCK;
8105                         } else {
8106                                 locks[i].brltype = WRITE_LOCK;
8107                         }
8108                 }
8109
8110                 /*
8111                  * There is no error code marked "stupid client bug".... :-).
8112                  */
8113                 if(err) {
8114                         reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8115                         END_PROFILE(SMBlockingX);
8116                         return;
8117                 }
8118         }
8119
8120         status = smbd_do_locking(req, fsp,
8121                                  locktype, lock_timeout,
8122                                  num_ulocks, ulocks,
8123                                  num_locks, locks,
8124                                  &async);
8125         if (!NT_STATUS_IS_OK(status)) {
8126                 END_PROFILE(SMBlockingX);
8127                 reply_nterror(req, status);
8128                 return;
8129         }
8130         if (async) {
8131                 END_PROFILE(SMBlockingX);
8132                 return;
8133         }
8134
8135         reply_outbuf(req, 2, 0);
8136         SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
8137         SSVAL(req->outbuf, smb_vwv1, 0);    /* no andx offset */
8138
8139         DEBUG(3, ("lockingX %s type=%d num_locks=%d num_ulocks=%d\n",
8140                   fsp_fnum_dbg(fsp), (unsigned int)locktype, num_locks, num_ulocks));
8141
8142         END_PROFILE(SMBlockingX);
8143 }
8144
8145 #undef DBGC_CLASS
8146 #define DBGC_CLASS DBGC_ALL
8147
8148 /****************************************************************************
8149  Reply to a SMBreadbmpx (read block multiplex) request.
8150  Always reply with an error, if someone has a platform really needs this,
8151  please contact vl@samba.org
8152 ****************************************************************************/
8153
8154 void reply_readbmpx(struct smb_request *req)
8155 {
8156         START_PROFILE(SMBreadBmpx);
8157         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8158         END_PROFILE(SMBreadBmpx);
8159         return;
8160 }
8161
8162 /****************************************************************************
8163  Reply to a SMBreadbs (read block multiplex secondary) request.
8164  Always reply with an error, if someone has a platform really needs this,
8165  please contact vl@samba.org
8166 ****************************************************************************/
8167
8168 void reply_readbs(struct smb_request *req)
8169 {
8170         START_PROFILE(SMBreadBs);
8171         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8172         END_PROFILE(SMBreadBs);
8173         return;
8174 }
8175
8176 /****************************************************************************
8177  Reply to a SMBsetattrE.
8178 ****************************************************************************/
8179
8180 void reply_setattrE(struct smb_request *req)
8181 {
8182         connection_struct *conn = req->conn;
8183         struct smb_file_time ft;
8184         files_struct *fsp;
8185         NTSTATUS status;
8186
8187         START_PROFILE(SMBsetattrE);
8188         ZERO_STRUCT(ft);
8189
8190         if (req->wct < 7) {
8191                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8192                 goto out;
8193         }
8194
8195         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8196
8197         if(!fsp || (fsp->conn != conn)) {
8198                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8199                 goto out;
8200         }
8201
8202         /*
8203          * Convert the DOS times into unix times.
8204          */
8205
8206         ft.atime = convert_time_t_to_timespec(
8207             srv_make_unix_date2(req->vwv+3));
8208         ft.mtime = convert_time_t_to_timespec(
8209             srv_make_unix_date2(req->vwv+5));
8210         ft.create_time = convert_time_t_to_timespec(
8211             srv_make_unix_date2(req->vwv+1));
8212
8213         reply_outbuf(req, 0, 0);
8214
8215         /*
8216          * Patch from Ray Frush <frush@engr.colostate.edu>
8217          * Sometimes times are sent as zero - ignore them.
8218          */
8219
8220         /* Ensure we have a valid stat struct for the source. */
8221         status = vfs_stat_fsp(fsp);
8222         if (!NT_STATUS_IS_OK(status)) {
8223                 reply_nterror(req, status);
8224                 goto out;
8225         }
8226
8227         if (!(fsp->access_mask & FILE_WRITE_ATTRIBUTES)) {
8228                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
8229                 goto out;
8230         }
8231
8232         status = smb_set_file_time(conn, fsp, fsp->fsp_name, &ft, true);
8233         if (!NT_STATUS_IS_OK(status)) {
8234                 reply_nterror(req, status);
8235                 goto out;
8236         }
8237
8238         DEBUG( 3, ( "reply_setattrE %s actime=%u modtime=%u "
8239                " createtime=%u\n",
8240                 fsp_fnum_dbg(fsp),
8241                 (unsigned int)ft.atime.tv_sec,
8242                 (unsigned int)ft.mtime.tv_sec,
8243                 (unsigned int)ft.create_time.tv_sec
8244                 ));
8245  out:
8246         END_PROFILE(SMBsetattrE);
8247         return;
8248 }
8249
8250
8251 /* Back from the dead for OS/2..... JRA. */
8252
8253 /****************************************************************************
8254  Reply to a SMBwritebmpx (write block multiplex primary) request.
8255  Always reply with an error, if someone has a platform really needs this,
8256  please contact vl@samba.org
8257 ****************************************************************************/
8258
8259 void reply_writebmpx(struct smb_request *req)
8260 {
8261         START_PROFILE(SMBwriteBmpx);
8262         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8263         END_PROFILE(SMBwriteBmpx);
8264         return;
8265 }
8266
8267 /****************************************************************************
8268  Reply to a SMBwritebs (write block multiplex secondary) request.
8269  Always reply with an error, if someone has a platform really needs this,
8270  please contact vl@samba.org
8271 ****************************************************************************/
8272
8273 void reply_writebs(struct smb_request *req)
8274 {
8275         START_PROFILE(SMBwriteBs);
8276         reply_force_doserror(req, ERRSRV, ERRuseSTD);
8277         END_PROFILE(SMBwriteBs);
8278         return;
8279 }
8280
8281 /****************************************************************************
8282  Reply to a SMBgetattrE.
8283 ****************************************************************************/
8284
8285 void reply_getattrE(struct smb_request *req)
8286 {
8287         connection_struct *conn = req->conn;
8288         int mode;
8289         files_struct *fsp;
8290         struct timespec create_ts;
8291
8292         START_PROFILE(SMBgetattrE);
8293
8294         if (req->wct < 1) {
8295                 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
8296                 END_PROFILE(SMBgetattrE);
8297                 return;
8298         }
8299
8300         fsp = file_fsp(req, SVAL(req->vwv+0, 0));
8301
8302         if(!fsp || (fsp->conn != conn)) {
8303                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
8304                 END_PROFILE(SMBgetattrE);
8305                 return;
8306         }
8307
8308         /* Do an fstat on this file */
8309         if(fsp_stat(fsp)) {
8310                 reply_nterror(req, map_nt_error_from_unix(errno));
8311                 END_PROFILE(SMBgetattrE);
8312                 return;
8313         }
8314
8315         mode = dos_mode(conn, fsp->fsp_name);
8316
8317         /*
8318          * Convert the times into dos times. Set create
8319          * date to be last modify date as UNIX doesn't save
8320          * this.
8321          */
8322
8323         reply_outbuf(req, 11, 0);
8324
8325         create_ts = get_create_timespec(conn, fsp, fsp->fsp_name);
8326         srv_put_dos_date2((char *)req->outbuf, smb_vwv0, create_ts.tv_sec);
8327         srv_put_dos_date2((char *)req->outbuf, smb_vwv2,
8328                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_atime));
8329         /* Should we check pending modtime here ? JRA */
8330         srv_put_dos_date2((char *)req->outbuf, smb_vwv4,
8331                           convert_timespec_to_time_t(fsp->fsp_name->st.st_ex_mtime));
8332
8333         if (mode & FILE_ATTRIBUTE_DIRECTORY) {
8334                 SIVAL(req->outbuf, smb_vwv6, 0);
8335                 SIVAL(req->outbuf, smb_vwv8, 0);
8336         } else {
8337                 uint32 allocation_size = SMB_VFS_GET_ALLOC_SIZE(conn,fsp, &fsp->fsp_name->st);
8338                 SIVAL(req->outbuf, smb_vwv6, (uint32)fsp->fsp_name->st.st_ex_size);
8339                 SIVAL(req->outbuf, smb_vwv8, allocation_size);
8340         }
8341         SSVAL(req->outbuf,smb_vwv10, mode);
8342
8343         DEBUG( 3, ( "reply_getattrE %s\n", fsp_fnum_dbg(fsp)));
8344
8345         END_PROFILE(SMBgetattrE);
8346         return;
8347 }